278 matches found
New CISA Director Confirmed, W.H. Gains Cyber-Director
The U.S. has made a key move to shore up its cybersecurity strategy, with the confirmation of Jen Easterly as the director of the Cybersecurity and Infrastructure Security Agency CISA on Monday. Easterly, a former official at the National Security Agency from 2011 to 2013 and two-time Bronze Star...
Last Week’s Security news: PrintNightmare patches and Metasploit, Kaseya CVEs, Morgan Stanley Accellion FTA, Cisco BPA and WSA, Philips Vue PACS, CISA RVAs, Lazarus job offers
Hello guys! The third episode of Last Week’s Security news, July 5 - July 11. There was a lot of news last week. Most of them was again about PrintNightmare and Kaseya. The updates for PrintNightmare CVE-2021-34527 were finally released mid-week. It became possible not only to disable the service...
GHSA-94HH-PJJG-RWMR Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
Impact AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly observable difference in timing when padding error would occur while...
Russian Hacker Gets 12-Years Prison for Massive JP Morgan Chase Hack
A U.S. court on Thursday sentenced a 37-year-old Russian to 12 years in prison for perpetrating an international hacking campaign that resulted in the heist of a trove of personal information from several financial institutions, brokerage firms, financial news publishers, and other American...
morgan-multimedia.fr Cross Site Scripting vulnerability OBB-1378147
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
morgan-york.co.uk Cross Site Scripting vulnerability OBB-1367232
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Morgan Stanley Hobbes Out-of-Bounds Read/Write Vulnerability
Morgan Stanley Hobbes is an embedded language compiler and runtime program from Morgan Stanley USA. An out-of-bounds read/write vulnerability exists in Morgan Stanley Hobbes version 2020-05-21 and earlier. The vulnerability stems from a lack of boundary checking in the array implementation. An...
CVE-2020-13656
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...
CVE-2020-13656
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...
Out-of-bounds
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...
CVE-2020-13656
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...
CVE-2020-13656
Morgan Stanley Hobbes contains an out-of-bounds read/write vulnerability in its array implementation, reported up to 2020-05-21. The缺 bound checking flaw allows an attacker to trigger OOB access, enabling code execution via RPC. Affected version details: Hobbes 2020-05-21 and earlier (per CNVD-20...
CVE-2019-5413
The Node.js morgan package, before version 1.9.1, does not properly sanitize input in the compile function, allowing for potential execution of code. This vulnerability can only be exploited by attackers with the ability to provide input to the compile function or in combination with another...
stockplanconnect.morganstanley.com Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1092503 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Companies that Scrape Your Email
Motherboard has a long article on apps -- Edison, Slice, and Cleanfox -- that spy on your email by scraping your screen, and then sell that information to others: Some of the companies listed in the J.P. Morgan document sell data sourced from "personal inboxes," the document adds. A spokesperson...
Code Injection in morgan
Verisons of morgan before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. Recommendation Update to version 1.9.1 or later...
013-carrousel-multipe (=1.0.0), 0303-lb3-paket (=1.0.1) +18345 more potentially affected by CVE-2019-5413 via morgan (>=1.0.0 <=1.9.0)
morgan NPM version =1.0.0, =1.1.0, =1.0.2, =1.0.1, =1.0.2 and more Source cves: CVE-2019-5413 Source advisory: OSV:GHSA-GWG9-RGVJ-4H5J...
GHSA-GWG9-RGVJ-4H5J Code Injection in morgan
Verisons of morgan before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. Recommendation Update to version 1.9.1 or later...