NSA and CISA Release Guidance on Securing 5G Cloud Infrastructures

CISA has announced the joint National Security Agency NSA and CISA publication of the second of a four-part series, Security Guidance for 5G Cloud Infrastructures. Part II: Securely Isolate Network Resources examines threats to 5G container-centric or hybrid container/virtual network, also known ...

Microsoft unpacks comprehensive security at Gartner and Forrester virtual events

Every day, Microsoft is committed to maintaining comprehensive security for all across our interconnected global community. With that purpose in mind, we recently sponsored the 2021 Gartner Security and Risk Summit and 2021 Forester Security and Risk Forum, where we discussed ongoing changes in t...

Microsoft unpacks comprehensive security at Gartner and Forrester virtual events

Every day, Microsoft is committed to maintaining comprehensive security for all across our interconnected global community. With that purpose in mind, we recently sponsored the 2021 Gartner Security and Risk Summit and 2021 Forester Security and Risk Forum, where we discussed ongoing changes in t...

DuckDuckGo Wants to Stop Apps From Tracking You on Android

The privacy-focused tech company's latest update promises to block invasive data collection across your whole phone...

Drupal Releases Security Updates

Drupal has released security updates to address vulnerabilities that could affect versions 8.9, 9.1, and 9.2. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Drupal Security Advisory SA-CORE-2021-011 and app...

Is Microsoft Stealing People’s Bookmarks?

I received email from two people who told me that Microsoft Edge enabled synching without warning or consent, which means that Microsoft sucked up all of their bookmarks. Of course they can turn synching off, but its too late. Has this happened to anyone else, or was this user error of some sort?...

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities

CISA, the Federal Bureau of Investigation FBI, the Australian Cyber Security Centre ACSC, and the United Kingdom’s National Cyber Security Centre NCSC have released a joint Cybersecurity Advisory highlighting ongoing malicious cyber activity by an advanced persistent threat APT group that FBI,...

200M Adult Cam Model, User Records Exposed in Stripchat Breach

UPDATE A database containing the highly sensitive information on both users and models on the popular adult cam site Stripchat were discovered online, left completely unprotected. The data exposure puts models and users at risk of extortion, violence and more. Stripchat is a popular site founded ...

CVE-2021-26322

CVE-2021-26322 describes a vulnerability where the persistent platform private key may not be protected with a random IV, enabling a potential two-time pad attack. Affected hardware/firmware per provided documents: AMD Secure Processor (ASP) and AMD EPYC platform components across 1st–3rd Gen EPY...

New Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

The White House, via Executive Order EO 14028: Improving the Nation’s Cybersecurity, tasked CISA, as the operational lead for federal cybersecurity, to “develop a standard set of operational procedures i.e., playbook to be used in planning and conducting cybersecurity vulnerability and incident...

Google Releases Security Updates for Chrome

Google has released Chrome version 96.0.4664.45 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review the Chrome Release Note and apply the necessary updates as...

The vulnerability of the application programming interface for data exchange via Google Chrome’s Web Share browser allows a perpetrator to influence the confidentiality, integrity, and accessibility of data.

The vulnerability of the application programming interface for data exchange via Google Chrome’s Web Share browser lies in the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise privacy, integrity, and accessibility of data...

in janeczku/calibre-web

Description A user can see the name of private shelves from other users when trying to remove a book of those shelves. Proof of Concept The file shelf.py in its line 221 exposes the name of the shelf when the user tries to remove a book from a shelf which is not his. log.warning"You are not allow...

The Sneaky Way TikTok Is Connecting You to Real-Life Friends

The social network got huge by ignoring who you know. That's increasingly no longer the case...

CISA Releases Advisory on Vulnerabilities in Multiple Data Distribution Service Implementations 

CISA has released an Industrial Control Systems Advisory ICSA related to a public report detailing vulnerabilities found in multiple open-source and proprietary Object Management Group OMG Data-Distribution Service DDS implementations. Successful exploitation of these vulnerabilities could result...

Palo Alto Networks Release Security Updates for PAN-OS

Palo Alto Networks has released security updates to address a vulnerability affecting PAN-OS firewall configurations with GlobalProtect portal and gateway interfaces. These updates address a vulnerability that only affects old versions of PAN-OS 8.1.16 and earlier. An unauthenticated attacker wit...

Legion Phone Pro（L79031）和Legion Phone2 Pro（L70081）上时间天气系统小部件 安全漏洞

The Lenovo Legion Phone Pro and Legion Phone2 Pro are both gaming phones from the Chinese company Lenovo. A security vulnerability in the Time Weather System widget on the Legion Phone Pro L79031 and Legion Phone2 Pro L70081 can be exploited by an attacker to access the device's GPS data via othe...

Mozilla Firefox Security Advisory (MFSA2013-25) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Apple Releases Security Update for iCloud for Windows 13

Apple has released a security update to address multiple vulnerabilities in iCloud for Windows 13. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Apple security page and apply the necessary update. This...

VMware Releases Security Advisory

VMware has released a security advisory to address a privilege escalation vulnerability in vCenter Server and Cloud Foundation. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory...