10774 matches found
Update Your Windows Computers to Patch 6 New In-the-Wild Zero-Day Bugs
Microsoft on Tuesday released another round of security updates for Windows operating system and other supported software, squashing 50 vulnerabilities, including six zero-days that are said to be under active attack. The flaws were identified and resolved in Microsoft Windows, .NET Core and Visu...
SUSE: Security Advisory (SUSE-SU-2020:3372-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Weak Password Vulnerability in Beidou Active Security Cloud Platform
Founded in March 2012, Hunan Changshang Technology Co., Ltd. is a high-tech enterprise integrating R&D, manufacturing, sales and service of electronic technology and its related products. There is a weak password vulnerability in Beidou Active Security Cloud Platform, which can be exploited by...
Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits
Microsoft jumped on 50 vulnerabilities in this month’s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge Chromium-based and EdgeHTML, SharePoint Server, Hyper-V, Visual Studio Code – Kubernetes Tools, Windows HTML...
CVE-2021-28382
Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...
CVE-2021-28382
Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...
CVE-2021-28382
Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...
GitHub Updates Policy to Remove Exploit Code When Used in Active Attacks
Code-hosting platform GitHub Friday officially announced a series of updates to the site's policies that delve into how the company deals with malware and exploit code uploaded to its service. "We explicitly permit dual-use security technologies and content related to research into vulnerabilitie...
GSD-2021-1000248 RDMA/rtrs-clt: destroy sysfs after removing session from active list
RDMA/rtrs-clt: destroy sysfs after removing session from active list This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.4 by commit...
UVI-2021-1000248 RDMA/rtrs-clt: destroy sysfs after removing session from active list
RDMA/rtrs-clt: destroy sysfs after removing session from active list This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.4 by commit...
GSD-2021-1000359 RDMA/rtrs-clt: destroy sysfs after removing session from active list
RDMA/rtrs-clt: destroy sysfs after removing session from active list This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.37 by commit...
Breaking down NOBELIUM’s latest early-stage toolset
As we reported in earlier blog posts, the threat actor NOBELIUM recently intensified an email-based attack that it has been operating and evolving since early 2021. We continue to monitor this active attack and intend to post additional details as they become available. In this blog, we highlight...
CVE-2021-33394
Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker...
Session fixation
Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker...
CVE-2020-26558
A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing SSP, Secure Connections SC and LE Secure Connections LESC of the Bluetooth Core Specification is vulnerable to an impersonation attack where an active attacker can impersonate the initiating device...
Telegram: Security bypass
Background Telegram is a cloud-based mobile and desktop messaging app with a focus on security and speed. Description It was discovered that Telegram failed to invalidate a recently active session. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...
2021 Attacker Dwell Time Trends and Best Defenses
Cyberattacks have shifted from the usual smash-and-grab type of heists to stealthier campaigns where hackers silently camp out on networks for long periods, stealing anything they can get their hands on. Called attacker dwell time, this is part of an adversarial approach that has become even more...
CVE-2021-28112
Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker...