Microsoft Patch Tuesday for August 2021 — Snort rules and prominent vulnerabilities

By Jon Munshaw, with contributions from Martin Lee. Microsoft released its monthly security update Tuesday, disclosing 44 vulnerabilities in the company’s firmware and software. This is the fewest amount of vulnerabilities Microsoft has patched in a month in more than two years. There... This is...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...

Directory Traversal

github.com/grafana/loki is vulnerable to directory traversal. An attacker is able to input malicious rules files with a pathname in the header value X-Scope-OrgID that will expose the location and contents at that location...

Directory traversal

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

Directory traversal

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that...

CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

CVE-2021-36157

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that...

Holiday Readiness: What You Should Be Thinking About Four Months Out

Written by: Michael Hansen This is a blog series about Akamai solutions that can help you manage the surge of traffic both good and bad that will be hitting the retail industry during the holiday season. The beginning of August is upon us, and if you haven't already started thinking about the...

The Shapeshifting Cam Girl Rewriting the Rules of Porn

Face-morphing adult content creator Coconut Kitty is ushering in the unsettling future of the medium, one where nothing is as it seems...

openSUSE: Security Advisory for systemd (openSUSE-SU-2021:1082-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:1082-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service in systemd via unitnamepathescape bsc1188063 - Skip udev rules if 'elevator=' is used bsc1184994 This update was imported from the SUSE:SLE-15:Update update project...

openSUSE: Security Advisory for systemd (openSUSE-SU-2021:2404-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE: Security Advisory (SUSE-SU-2021:2404-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Clean As You Code essentials - What are Quality Profiles and Quality Gates?

In this blog, well focus on rules, Quality Profiles and Quality Gates. These elements are the building blocks of an effective Clean As You Code strategy. After reading this article, you’ll have a better understanding of what they are and how they’re used in the pursuit of clean, quality code for...

OPENSUSE-SU-2021:2404-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service in systemd via unitnamepathescape bsc1188063 - Skip udev rules if 'elevator=' is used bsc1184994...

SUSE-SU-2021:2404-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service in systemd via unitnamepathescape bsc1188063 - Skip udev rules if 'elevator=' is used bsc1184994...

GHSA-VJV5-GP2W-65VM Encoded URIs can access WEB-INF directory in Eclipse Jetty

Description URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. Impact The default compliance mode allows requests with UR...

Anonymous users can access the /rest/whitelist/<version>/check resource - CVE-2019-20101

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the /rest/whitelist//check endpoint. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1. Affected...

Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities

By Jon Munshaw, with contributions from Jaeson Schultz. Microsoft released its monthly security update Tuesday, disclosing 117 vulnerabilities across its suite of products, by far the most in a month this year. Today’s Patch Tuesday includes three vulnerabilities that Microsoft states are... This...

PT-2021-3894

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description The issue is related to an information disclosure vulnerability in Microsoft Exchange Server, associated with weaknesses in the authentication procedure. This vulnerability...