PT-2022-15251

Name of the Vulnerable Software and Affected Versions Teedy versions v1.5 through v1.9 Description The issue concerns Reflected Cross-Site Scripting XSS in the "search term" search functionality, which is not sufficiently sanitized, allowing the injection of arbitrary scripts. These scripts are...

PT-2022-1487

Name of the Vulnerable Software and Affected Versions CENTUM CS 3000 versions from R3.08.10 to R3.09.00 CENTUM VP versions from R4.01.00 to R4.03.00 CENTUM VP versions from R5.01.00 to R5.04.20 CENTUM VP versions from R6.01.00 to R6.08.00 Exaopc versions from R3.72.00 to R3.79.00 Description The...

N Korean hackers stole $1.7 billion from cryptocurrency exchanges

By Waqas Experts believe North Korean hackers are keeping the stolen funds as a long-term investment. This is a post from HackRead.com Read the original post: N Korean hackers stole $1.7 billion from cryptocurrency exchanges...

Microsoft Office 代码注入漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and edition...

CVE-2021-35346

tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::shorttermrefpicsetint in hevc.cpp...

PT-2021-20896

Name of the Vulnerable Software and Affected Versions: tsMuxer version 2.6.16 Description: A heap-based buffer overflow was discovered in tsMuxer via the function HevcSpsUnit::short term ref pic setint in hevc.cpp. This issue can be exploited, but no details are provided about the estimated numbe...

Intel Is Maintaining Legacy Technology for Security Research

Interesting: Intel’s issue reflects a wider concern: Legacy technology can introduce cybersecurity weaknesses. Tech makers constantly improve their products to take advantage of speed and power increases, but customers don’t always upgrade at the same pace. This creates a long tail of old product...

PT-2021-23999 · Freertos · Freertos

Name of the Vulnerable Software and Affected Versions: FreeRTOS versions 10.2.0 through 10.4.5 FreeRTOS versions through 10.4.6 Description: The issue affects FreeRTOS on ARMv7-M and ARMv8-M MPU platforms, where non-kernel code can call internal functions to raise privilege. This can lead to...

new module: nodejs:16

This enhancement update adds the nodejs:16 module to AlmaLinuxas a Technology Preview. A future update will provide a Long Term Support LTS version of Node.js 16, which will be fully supported. BZ1953991 For detailed information on changes in this release, see the AlmaLinux Release Notes linked...

CVE-2021-29843

IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203...

PT-2021-5282 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.318 and earlier Jenkins LTS versions 2.303.2 and earlier Description: The issue is related to the agent-to-controller security subsystem of Jenkins, where file path filters do not canonicalize paths. This allows operations ...

CVE-2021-0643

In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without the correct permissions due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed...

CVE-2021-0643

In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without the correct permissions due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed...

Microsoft Office Visio 代码注入漏洞

Microsoft Office Visio is the software responsible for drawing flowcharts and schematics in the Office software family of Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Office Visio. The following products and editions are affected:Microsoft Office LTSC 2021 for...

GnuPG fixes a problem with Let’s Encrypt certificate chain validation

Despite advance warnings that a root certificate provided by Let’s Encrypt would expire on September 30, users reported issues with a variety of services and websites once that deadline hit. So what happened? The problem A number of high profile tech and security companies noticed their products...

A security architect’s POV on a mature data-centric security program, Part 3

In part one of this series, you learned about the challenges associated with accessing, and searching long-term retained database activity logs and identifying sensitive customer data to comply with stricter compliance regulations. In part two, you gained insight into how security professionals c...

traitobject is Unmaintained

Crate traitobject has not had a release for over five years. In addition there is an existing security advisory that has not been addressed: - RUSTSEC-2020-0027 Possible Alternatives The below list has not been vetted in any way and may or may not contain alternatives; - destructuretraitobject...

Wire 代码问题漏洞

Wire-server is a backup server for the open source Wire secure messaging application. Wire-server has a security vulnerability that could be exploited to trigger a user's email address change using only a short-term session token in the "Authorization" header...

DRUPAL-CONTRIB-2021-031

The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with...

Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031

The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with...