bugs 跨站脚本漏洞

Bugs is a branch of the open source Tinyissue defect tracking system by Alexandre Plennevaux, a personal developer in Belgium. bugs 1.8 and earlier versions of install/index.php are vulnerable to cross-site scripting, which can be exploited by remote attackers to inject arbitrary Web script or HT...

Military’s RFID Tracking of Guns May Endanger Troops

Reports that the military has started outfitting firearms with RFID tags for tracking have raised security alarms. The concern: What if the enemy uses the tags to track soldiers on the battlefield? The Department of Defense, the Marines and the Navy have already rejected the RFID tagging tech for...

The vulnerability in the implementation of the HeapTrack_alloc() function (kernel/tirtos/packages/ti/sysbios/heaps/HeapTrack.c) of the software development kit for microcontroller series CC13XX, CC26XX, CC32XX, and MSP432E4 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the HeapTrackalloc function implementation kernel/tirtos/packages/ti/sysbios/heaps/HeapTrack.c in the software development kit for microcontroller series CC13XX, CC26XX, CC32XX, and MSP432E4 arises due to a numerical overflow condition. Exploiting this vulnerability can allow...

SUSE-SU-2021:3251-1 Security update for python-urllib3

This update for python-urllib3 fixes the following security issue: - CVE-2020-26137: A CRLF injection via HTTP request method was fixed bsc1177120 Note that this was fixed in a previous version update to 1.25.9, this update just complements the tracking...

Tracking Stolen Cryptocurrencies

Good article about the current state of cryptocurrency forensics...

Google, geofence warrants, and you

Another day, another example of how the data sharing choices we make can come back to haunt us. The Guardian reports a Florida resident finding his bike ride data requested by law enforcement. This is due to his route taking him close to the scene of a burglary a year earlier. According to the...

CVE-2021-22005

creationtimestamp| type| source ---|---|--- 2021-09-22 05:17:02+00:00| seen| https://t.me/thehackernews/1528 2021-09-22 14:26:45+00:00| exploited| https://t.me/ctinow/40137 2021-09-22 22:32:08+00:00| exploited| https://t.me/BleepingComputer/10542 2021-09-22 23:56:16+00:00| seen|...

What are computer cookies?

We all know cookies as tasty baked treats that we love to eat, but computer cookies are quite different. Although they’re most popularly known as just "cookies", they may be referred to as browser cookies, Internet cookies, HTTP cookies, web cookies, computer cookies, or digital cookies. What are...

Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

By Tiago Pereira and Vitor Ventura. Cisco Talos linked the recent aviation targeting campaigns to an actor who has been targeting the aviation industry for two years.The same actor has been running successful malware campaigns for more than five years.Although always using commodity malware, the...

Controller.inCaseStrategyGetStuck does not update balance

Handle cmichel Vulnerability details The Controller.inCaseStrategyGetStuck withdraws from a strategy but does not call updateBalancevault, strategy afterwards. Impact The vaultDetailsvault.balancesstrategy variable does not correctly track the actual strategy balance anymore. I'm not sure what...

CVE-2021-3709

Function checkattachmentforerrors in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to...

Deposits into vaults are not tracked at a token level

Handle itsmeSTYJ Vulnerability details Impact If the strategy used accepts multiple tokens, a user can deposit in a cheaper token and withdraw in a more expensive token because the vault only tracks ownership based on how many shares they own. Proof of Concept 1. An approved strategist adds 2...

CVE-2021-1861

An issue existed in determining cache occupancy. The issue was addressed through improved logic. This issue is fixed in macOS Big Sur 11.3. A malicious website may be able to track users by setting state in a cache...

Design/Logic Flaw

An issue existed in determining cache occupancy. The issue was addressed through improved logic. This issue is fixed in macOS Big Sur 11.3. A malicious website may be able to track users by setting state in a cache...

CVE-2021-1861

An issue existed in determining cache occupancy. The issue was addressed through improved logic. This issue is fixed in macOS Big Sur 11.3. A malicious website may be able to track users by setting state in a cache...

CVE-2021-1861

The CVE-2021-1861 issue concerns a logic fault in how cache occupancy is determined in macOS Big Sur components (notably Safari) that could allow a malicious website to track users by setting state in a cache. The vulnerability is addressed in macOS Big Sur 11.3 via improved cache state managemen...

CVE-2021-30744

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site...

CVE-2021-30744

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site...

Patch now! Netgear fixes serious smart switch vulnerabilities

In a security advisory, NetGear has announced it has fixed three vulnerabilities in firmware updates for several network devices. Most of the affected products are smart switches, some of them with cloud management capabilities that allow for configuring and monitoring them over the web. One of t...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...