404 matches found
Apple macOS Monterey Spotlight Privilege Permission and Access Control Issues Vulnerability
Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. Apple macOS Monterey prior to version 12.5 is vulnerable to a privilege-granting and access-control issue vulnerability that stems from Spotlight failing to properly impose security...
Apple macOS Monterey 权限许可和访问控制问题漏洞
Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. Apple macOS Monterey prior to version 12.5 is vulnerable to a privilege-granting and access-control issue vulnerability that stems from Spotlight failing to properly impose security...
May 24, 2022—KB5014019 (OS Build 22000.708) Preview
None None...
Apple macOS Monterey 后置链接漏洞
Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. A security vulnerability exists in Apple macOS Monterey versions 12.0 21A344 - 12.3.1 21E258, which stems from a symbolic link issue in Spotlight. A local attacker can exploit the...
Vulnerability Spotlight: Two vulnerabilities in Accusoft ImageGear could lead to DoS, arbitrary free
Emmanuel Tacheau of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered two new vulnerabilities in Accusoft ImageGear. The ImageGear library is a document-imaging developer toolkit that allows users to create, edit, annotate and convert... This is on...
Apple’s child safety features are coming to a Messages app near you
Apple will soon be rolling out its promised child safety features in the Messages app for users in Australia, Canada, New Zealand, and the UK. The announcement comes four months after the features initial launch in the US on the iOS, iPad, and macOS devices. To make communicating with Messages...
Researcher Spotlight: Liz Waddell, CTIR practice lead
How this Talos team member’s love of true crime led to a life in cybersecurity By Jon Munshaw. Liz Waddell is usually there on someone’s worst day of their professional lives. Chief technology officers and chief information security officers can hope all they want that the... This is only the...
Threat Spotlight: "Haskers Gang" Introduces New ZingoStealer
Update 04/14/22: Following the initial publication of this blog, we observed a new post in the Haskers Gang Telegram channel announcing that ownership of the ZingoStealer project is being transferred to a new threat actor. We also observed the malware author offering to sell the source code for...
WordPress Spotlight Social Media Feeds plugin < 0.10.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Spotlight Social Media Feeds plugin versions 0.10.2. Solution Update the WordPress Spotlight Social Media Feeds plugin to the latest available version at least 0.10.2...
WordPress Spotlight Social Media Feeds plugin < 0.10.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Spotlight Social Media Feeds plugin versions 0.10.2. Solution Update the WordPress Spotlight Social Media Feeds plugin to the latest available version at least 0.10.2...
Researcher Spotlight: Cyber Viking Nate Warfield is Here to Help
“There are few jobs where I can say, I make two billion people more secure on the internet every single day.” Childhood Look: Goth kid, all in black Current Look: Cyber Viking Childhood hobby: Head banging to Metallica, Marilyn Manson, and Guns N’ Roses Current hobby: n0x08 DJ’s Live events aroun...
Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF
A Cisco Talos team member discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in the Nitro Pro PDF reader that could allow an attacker to execute code in the context of the application. Nitro Pro PDF is part of Nitro Software’s... This i...
Vulnerability Spotlight: Out-of-bounds write vulnerabilities in Accusoft ImageGear
Emmanuel Tacheau of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple out-of-bounds write vulnerabilities in Accusoft ImageGear that an adversary could exploit to corrupt memory on the targeted machine. The ImageGear library is a... This i...
Vulnerability Spotlight: Use-after-free vulnerability in 3MF Consortium lib3mf
Lilith of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. 3MF Consortium’s lib3mf library is vulnerable to a use-after-free vulnerability that could allow an adversary to execute remote code on the victim machine. The lib3mf library is an open-source implementation of the 3MF file...
Vulnerability Spotlight: Remote code execution vulnerabilities in Schneider Electric EcoStruxure
Alexander Perez-Palma and Jared Rittle of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.Cisco Talos recently discovered two code execution vulnerabilities in Schneider Electric EcoStruxure. An attacker could exploit these vulnerabilities by sending the victim a specially crafted...
spotlight-sha.de Cross Site Scripting vulnerability OBB-1383652
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Afternoon Cyber Tea: Peak, Plateau, or Plummet? Cyber security trends that are here to stay and how to detect and recover from ransomware attacks
The rapidity of change in the cyberthreat landscape can be daunting for today’s cyber defense teams. Just as they perfect the ability to block one attack method, adversaries change their approach. Tools like artificial intelligence and machine learning allow us to pivot quickly, however, knowing...
Afternoon Cyber Tea: Cybersecurity & IoT: New risks and how to minimize them
Recently, Microsoft announced our acquisition of CyberX, a comprehensive network-based security platform with continuous threat monitoring and analytics. This solution builds upon our commitment to provide a unified IoT security solution that addresses connected devices spread across both...
CVE-2020-1279
An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka 'Windows Lockscreen Elevation of Privilege Vulnerability'...
