SolarWinds Orion Platform SQL Injection Vulnerability

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and profiling of network devices and supports custom web interfaces, multiple user opinions, and map-based browsing of the entire network. The...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Google WebRTC 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome WebRTC. The vulnerability is caused by post-release use in WebRTC. A remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service...

Google WebRTC 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome WebRTC. The vulnerability is caused by post-release use in WebRTC. A remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service...

OPENSUSE-SU-2021:1208-1 Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.18: Fix missing time parameter on FROMUNIXTIME function cacti 1.2.18: CVE-2020-14424: Lack of escaping on template import can lead to XSS exposure under 'midwinter' theme boo1188188 Real time graphs can expose XSS issu...

CVE-2021-30602

Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page...

OPENSUSE-SU-2021:1190-1 Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.18: Fix missing time parameter on FROMUNIXTIME function cacti 1.2.18: CVE-2020-14424: Lack of escaping on template import can lead to XSS exposure under 'midwinter' theme boo1188188 Real time graphs can expose XSS issu...

Cars and hospital equipment running Blackberry QNX may be affected by BadAlloc vulnerability

Following an announcement by Blackberry the U.S. Food & Drug Administration FDA and the Cybersecurity & Infrastructure Security Agency CISA have put out alerts that vulnerabilities found in the Blackberry QNX real-time operating system RTOS may introduce risks for certain medical devices...

BadAlloc Flaw Affects BlackBerry QNX Used in Millions of Cars and Medical Devices

A major vulnerability affecting older versions of BlackBerry's QNX Real-Time Operating System RTOS could allow malicious actors to cripple and gain control of a variety of products, including cars, medical, and industrial equipment. The shortcoming CVE-2021-22156, CVSS score: 9.0 is part of a...

Vulnerability fixed in BlackBerry QNX Real Time Operating System, QNX SDP, QNX OS for Safety, and QNX OS for Medical

Blackberry has fixed a vulnerability in QNX Real Time Operating System. The vulnerability is known by attribute CVE-2021-22156 and is part of a collection of vulnerabilities known as BadAlloc. A malicious person who manages to gain access to a vulnerable system can exploit the exploit the...

Microsoft Edge 资源管理错误漏洞

Chrome is a web browsing tool developed by Google. A post-release reuse vulnerability exists in WebRTC in versions of Google Chrome prior to 92.0.4515.159. An attacker could exploit this vulnerability to potentially cause heap corruption via a crafted HTML page...

UBUNTU-CVE-2021-38381

Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash...

UBUNTU-CVE-2021-38382

Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RLSA-2021:3088 Important: kernel-rt security and bug fix update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: race condition in net/can/bcm.c leads to local privilege escalation CVE-2021-3609 kernel: Improper handling of VMIO|VMPFNMAP vmas ...

CVE-2021-36584

An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gprtpbuilderdotx3g function in ietf/rtppck3gpp.c, as demonstrated by MP4Box. This can cause a denial of service DOS...

UBUNTU-CVE-2021-36584

An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gprtpbuilderdotx3g function in ietf/rtppck3gpp.c, as demonstrated by MP4Box. This can cause a denial of service DOS...

Solarwinds Orion Platform has an unspecified vulnerability

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices, and supports custom web interfaces, multiple user opinions, and map-based browsing of the entire network, etc....

Zero Trust Should Not Give IT a Bad Name

Maybe you've just found out that your company's IT organization is implementing Zero Trust. Does that mean they don't trust you? "Zero Trust" sure sounds that way. Maybe you've read about it online or heard somebody talk about it in terms that equate Zero Trust with the idea that users and device...