[SECURITY] Fedora 34 Update: libslirp-4.4.0-4.fc34

A general purpose TCP-IP emulator used by virtual machine hypervisors to provide virtual networking services...

Unauthorized Access Vulnerability in web3.0 of Central Time Attendance Machine of Entropy Base Technology Co.

Entropy Base Technology Co., Ltd Entropy Base Technology is a national high-tech enterprise specializing in providing smart identity verification, smart entrance/exit management and smart office products and solutions with biometrics as the core technology. Entropy Base Technology Co., Ltd. china...

3 Steps to Strengthen Your Ransomware Defenses

The recent tsunami of ransomware has brought to life the fears of downtime and data loss cybersecurity pros have warned about, as attacks on the energy sector, food supply chain, healthcare industry, and other critical infrastructure have grabbed headlines. For the industry experts who track the...

Google TensorFlow Arbitrary File Overwrite Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from an arbitrary file overwrite vulnerability, which originates from an issue caused when tf.keras.utils.getfile is used with extract=True, and can be exploited by an...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-46658)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in TensorFlow 2.4.2,2.3.3,2.2.3, 2.1.4, which can be exploited by an attacker to trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-46659)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in TensorFlow 2.4.2,2.3.3,2.2.3,2.1.4, which stems from the fact that tf.rawops.SparseCountSparseOutput causes a segmentation error to be thrown from the standard...

Google TensorFlow code issue vulnerability (CNVD-2021-46656)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code issue vulnerability exists in TensorFlow 2.4.2,2.3.3,2.2.3,2.1.4, which can be exploited by an attacker to cause a denial of service by exploiting a CHECK failure from the implementation...

Keystone Engine 安全漏洞

Keystone Engine is an assembler framework. A security vulnerability exists in Keystone Engine that stems from Keystone Engine having an invalid idle in llvmks::SmallVectorImpl::SmallVectorImpl...

Delta Electronics Industrial Automation DOPSoft 缓冲区错误漏洞

Delta Electronics Industrial Automation DOPSoft is a set of human machine interface HMI software from Delta Electronics Taiwan, China. A buffer error vulnerability exists in Delta Electronics Industrial Automation DOPSoft that stems from the affected product's susceptibility to out-of-bounds read...

UVI-2021-1000957 usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port

usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.44 by...

Do CAPTCHAs work and what’s the alternative?

We know youre busy, so the answer is “No”. Users want less friction, and a good bot detection and mitigation solution will do the job MUCH better. The first lesson on the first day of UI school is that users want the path of least resistance. While the gamification of cybersecurity does have a...

WAF-A-MoLE - A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls

A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessin...

Google now requires app developers to verify their address and use 2FA

Google on Monday announced new measures for the Play Store, including requiring developer accounts to turn on 2-Step Verification 2SV, provide an address, and verify their contact details later this year. The new identification and two-factor authentication requirements are a step towards...

The vulnerability of the portal/patient/_machine_config.php component of the software for managing medical organizations OpenEMR allows a intruder to gain unauthorized access to protected information.

The vulnerability of the portal/patient/machineconfig.php component of the software for managing medical organizations OpenEMR is related to insufficient checking of permission assignment for critical resources. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gai...

Weak Password Vulnerability in Huawei Technologies Limited HG8240

The Huawei HG8240 is an all-in-one optical cat routing unit with routing capabilities. A weak password vulnerability exists in the Huawei Technologies HG8240, which can be exploited by attackers to obtain sensitive information...

Command Injection in sofianehamlaoui/lockdoor-framework

✍️ Description CI in Spaghetti function when it asks for proxy. 🕵️‍♂️ Proof of Concept // PoC https://drive.google.com/file/d/1R8R261eHUPVK6BQRsemaU5CI3QpCI8d-/view?usp=sharing 💥 Impact command run as root. So an attacker could do potential damage to the machine...

Command Injection in sofianehamlaoui/lockdoor-framework

✍️ Description inurlbr function is vulnerable to CI of exploitation.py 🕵️‍♂️ Proof of Concept // PoC https://drive.google.com/file/d/1HpID3CrNAqK7t0C2JttP75Eqptha6r-D/view?usp=sharing 💥 Impact command run as root. So an attacker could do potential damage to the machine...

[SECURITY] Fedora 33 Update: openssh-8.4p1-7.fc33

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Critical VMware Carbon Black Bug Allows Auth Bypass

VMware has fixed an uber-severe bug in its Carbon Black App Control AppC management server: A server whose job is to lock down critical systems and servers so they don’t get changed willy-nilly. AppC also ensures that organizations stay in continuous compliance with regulatory mandates. This is a...

VulnCheck KEV: CVE-2021-1498

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user...