New Hack Lets Attackers Bypass MasterCard PIN by Using Them As Visa Card

Cybersecurity researchers have disclosed a novel attack that could allow criminals to trick a point of sale terminal into transacting with a victim's Mastercard contactless card while believing it to be a Visa card. The research, published by a group of academics from ETH Zurich, builds on a stud...

Important: Red Hat Security Advisory: xterm security update

An update for xterm is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

xterm security update

An update is available for xterm. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The xterm program is a terminal emulator for the X Window System. It provides D...

Important: xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly. Security Fixes: xterm: crash when processing combining characters CVE-2021-27135 For more details about the...

RLSA-2021:0611 Important: xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly. Security Fixes: xterm: crash when processing combining characters CVE-2021-27135 For more details about the...

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

A locking vulnerability was found in the tty subsystem of the Linux kernel in drivers/tty/ttyjobctrl.c. This flaw allows a local attacker to possibly corrupt memory or escalate privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

CVE-2021-27188

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account...

CVE-2021-27187

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked...

CVE-2021-27187

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked...

[ASA-202102-22] helm: insufficient validation

Arch Linux Security Advisory ASA-202102-22 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2021-21303 Package : helm Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-1539 Summary ======= The package helm before version...

Design/Logic Flaw

Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted...

EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-1261)

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In ISC BIND9 versions BIND 9.11.14 - 9.11.19, BIND 9.14.9 - 9.14.12, BIND 9.16.0 - 9.16.3, BIND Supported Preview Edition 9.11.14-S1 - 9.11.19-S1:...

Prototype Pollution in kettek/dot-dotty

Description dot-dotty is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js const DotDotty = require'dot-dotty' let obj = a: 1 let dot = DotDottyobj console.log"Before : " + .polluted; dot'proto.polluted' = 'Yes! Its Polluted'; console.log"After : " +...

A New Linux Malware Targeting High-Performance Computing Clusters

High-performance computing clusters belonging to university networks as well as servers associated with government agencies, endpoint security vendors, and internet service providers have been targeted by a newly discovered backdoor that gives attackers the ability to execute arbitrary commands o...

Uroboros - A GNU/Linux Monitoring And Profiling Tool Focused On Single Processes

Uroboros is a GNU/Linux monitoring tool focused on single processes. While utilities like top, ps and htop provide great overall details, they often lack useful temporal representation for specific processes, such visual representation of the process data points can be used to profile, debug and...

Xshell 7 suffers from a power-raising vulnerability

Xshell7 is a remote terminal connection management software. Xshell7 has an elevation of privilege vulnerability that can be exploited by attackers to elevate privileges...

Denial of Service Vulnerability in ZXHN F412 at ZTE CORPORATION

The ZXHN F412 is a simple xPON HGU terminal for FTTH scenarios. A denial of service vulnerability exists in the ZXHN F412 of ZTE Corporation, which can be exploited by attackers to cause a denial of service attack...

CVE-2020-28221

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE version details in the notification that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI...

Duf - Disk Usage/Free Utility (Linux, BSD, macOS & Windows)

Disk Usage/Free Utility Linux, BSD, macOS & Windows Features User-friendly, colorful output Adjusts to your terminal's width Sort the results according to your needs Groups & filters devices Can conveniently output JSON Installation Packages Linux Arch Linux: duf Nix: nix-env -iA nixpkgs.duf...

CVE-2020-28221

CVE-2020-28221 is an improper input validation (CWE-20) vulnerability in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE. The issue could allow arbitrary code execution when the Ethernet Download feature is enabled on the HMI. The provided sources identify the affected products but do not...