The vulnerabilities of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud antivirus protection systems are related to authentication mechanism flaws, which allow attackers to trigger service denial-of-service attacks.

The vulnerabilities of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud are related to deficiencies in the authentication mechanism. Exploiting these vulnerabilities can allow attackers to trigger a service...

Applications are Not Enumerating for Users when Logging on to StoreFront

When the user logs on to StoreFront, applications are not appearing for the user to launch. No error messages are displayed. When you check the users account in XenApp, the user accounthas applications configured for it...

Command Execution Vulnerability in Yii2

Yii2 is a component-based PHP framework for rapid development of modern web applications. Yii2 suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

Oracle Linux 8 : flatpak (ELSA-2021-1068)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1068 advisory. 1.6.2-6 - Fix CVE-2021-21381 1938062 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus ha...

SAP Bugs Under Active Cyberattack

Active cyberattacks on known vulnerabilities in SAP systems could lead to full control of unsecured SAP applications, researchers are warning. Adversaries are carrying out a range of attacks, according to an alert from SAP and security firm Onapsis issued Tuesday – including theft of sensitive...

GHSA-XW22-WV29-3299 ApiKey secret could be revelated on network issue

Impact What kind of vulnerability is it? Who is impacted? Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too Patches Has the problem been patched? What versions should users upgrade to? creharmony/node-etsy-client18 fixes this issu...

GHSA-MMHJ-4W6J-76H7 Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate

Versions of isolated-vm before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference's full prototype chain. In an...

Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate

Versions of isolated-vm before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference's full prototype chain. In an...

Watch Out! Mission Critical SAP Applications Are Under Active Attack

Cyber attackers are actively setting their sights on unsecured SAP applications in an attempt to steal information and sabotage critical processes, according to new research. "Observed exploitation could lead in many cases to full control of the unsecured SAP application, bypassing common securit...

Amazon Linux 2 : flatpak (ALAS-2021-1625)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1625 advisory. A sandbox escape flaw was found in the way flatpak handled special tokens in .desktop files. This flaw allows an attacker to gain...

NATS Server Access Control Error Vulnerability

NATS Server is an open source messaging system. The system is mainly used for cloud-native applications, IoT messaging and microservices architecture. An access control error vulnerability exists in NATS Server 2.x before 2.2.0 and JWT library before 2.0.1, which stems from improper handling of...

Malicious Cyber Activity Targeting Critical SAP Applications

SAP systems running outdated or misconfigured software are exposed to increased risks of malicious attacks. SAP applications help organizations manage critical business processes—such as enterprise resource planning, product lifecycle management, customer relationship management, and supply chain...

The vulnerability of the transformation function for web applications used in phpMyAdmin administration systems allows attackers to execute cross-site scripting attacks.

The vulnerability of the transformation function for web applications used in phpMyAdmin administration systems is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially...

How Cyrebro Can Unify Multiple Cybersecurity Defenses to Optimize Protection

Many enterprises rely on more than one security tool to protect their technology assets, devices, and networks. This is particularly true for organizations that use hybrid systems or a combination of cloud and local applications. Likewise, companies whose networks include a multitude of smartphon...

Google limits which apps can access the list of installed apps on your device

Apps on Android have been able to infer the presence of specific apps, or even collect the full list of installed apps on the device. What's more, an app can also set to be notified when a new app is installed. Apart from all the usual concerns about misuse of such a data grab, the information ca...

PT-2021-3089 · Microsoft · Office +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to incorrect management of code generation when processing a COM object Graph in Microsoft Office and Microsoft Office Web Apps. This can be exploited by an...

Sourcecodester Simple College Website SQL Injection Vulnerability (CNVD-2021-95934)

Sourcecodester Simple College Website is a content management system from Sourcecodester. Sourcecodester Simple College Website suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in database-based applications, which can be exploit...

Threat Source Newsletter (April 1, 2021)

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We hope you’re enjoying Cisco Live this week and only reading this after you’ve caught up on your sessions for the day. No April Fool’s jokes here thankfully — we are just excited to tell you that applications... This is only the...

How to Vaccinate Against the Poor Password Policy Pandemic

Data breaches remain a constant threat, and no industry or organization is immune from the risks. From Fortune 500 companies to startups, password-related breaches continue to spread seemingly unchecked. As a result of the volume of data breaches and cybersecurity incidents, hackers now have acce...

Binary Vulnerability in Microsoft DirectComposition

DirectComposition is a graphical interface rendering framework introduced by Microsoft in the kernel since Windows 8, mainly used for rendering windows, interfaces and animations of UWP applications. A binary vulnerability exists in Microsoft DirectComposition, which can be exploited by attackers...