Attackers Impersonate DoT in Two-Day Phishing Scam

Threat actors impersonated the U.S. Department of Transportation USDOT in a two-day phishing campaign that used a combination of tactics – including creating new domains that mimic federal sites so as to appear to be legitimate – to evade security detections. Between Aug. 16-18, researchers at...

Nextcloud: Folder architecture and Filesizes of private file drop shares can be getten

Steps To Reproduce: 1. Create a new Folder "TestABC" 2. Share a password protected link of this folder 3. Create a file "README.md" and a file "README.md" in the Subfolder "Subfolder". == curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345"...

‘Azurescape’ Kubernetes Attack Allows Cross-Container Cloud Compromise

A critical security vulnerability allowing attackers to perform cross-account container takeover in Microsoft’s public cloud, dubbed “Azurescape”, has been uncovered by researchers. The issue exists in Azure Container Instances ACI, which is Microsoft’s container-as-a-service CaaS offering which...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.29 bug fix and security update

Red Hat OpenShift Container Platform release 4.7.29 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a...

PT-2021-7295 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.15 rc7 Description: The issue is related to incomplete cleanup of temporary or auxiliary resources in the arch/x86/kvm/lapic.c component of the Kernel-based Virtual Machine KVM subsystem in the Linux kernel...

architecturecompetitions.com Cross Site Scripting vulnerability OBB-2132751

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

OESA-2021-1331 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: arch/x86/kvm/mmu/pagingtmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.CVE-2021-38198...

Architecture Guideline for NEC EXPRESSCLUSTER X

Challenge When using NEC EXPRESSCLUSTER X NEC CLUSTERPRO X in Japan Market with Veeam Agent for Microsoft Windows or Veeam Backup & Replication, there are specific configuration requirements to ensure successful backup and restores. Solution Please refer to the Software Integration Guide on the N...

IBM AIX 权限许可和访问控制问题漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by the U.S. company IBM. There is a privilege permission and access control issue vulnerability in several IBM applications. The vulnerability stems from the lack of effective privilege permission an...

Wrong memory orderings violates mutual exclusion in spin

Wrong memory orderings inside the RwLock implementation allow for two writers to acquire the lock at the same time. The drop implementation used Ordering::Relaxed, which allows the compiler or CPU to reorder a mutable access on the locked data after the lock has been yielded. Only users of the...

Crypto vulnerability management

In this blog series, weve discussed in detail how crypto assets and currencies are no longer passing fads. Even if your C-suite remains skeptical, security leaders and teams cant afford to keep watching, waiting, and speculating about whats going to happen or when your organization will be direct...

Brutus - An Educational Exploitation Framework Shipped On A Modular And Highly Extensible Multi-Tasking And Multi-Processing Architecture

An educational exploitation framework shipped on a modular and highly extensible multi-tasking and multi-processing architecture. Brutus: an Introduction Looking for version 1? See the branches in this repository. Brutus is an educational exploitation framework written in Python. It automates pre...

Microsoft and NIST collaborate on EO to drive Zero Trust adoption

2020s Nobelium attack sent shock waves through both government and private sectors. 2021 has already seen large-scale nation-state attacks such as Hafnium1 alongside major ransomware attacks2 on critical infrastructure. The breadth and boldness of these attacks show that, far from being deterred,...

Intel BIOS Shared SW Architecture 默认配置问题漏洞

Intel BIOS Shared SW Architecture Intel BSSA is a BIOS shared software architecture from Intel Corporation USA. A default configuration issue vulnerability exists in the Intel BIOS Shared SW Architecture DFT that stems from an insecure default variable initialization of the Intel BSSA DFT feature...

arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page leading to a missing guest protection page fault.

...

IBM QRadar SIEM Information Disclosure Vulnerability (CNVD-2021-88197)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. An information...

CVE-2021-38569

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.23 security update

Red Hat OpenShift Container Platform release 4.7.23 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Foxit Reader 安全漏洞

Foxit Reader is a PDF document reader from the Chinese company Foxit. A security vulnerability exists in Foxit Reader versions prior to 10.1.4 and PhantomPDF versions prior to 10.1.4, which stems from the software's incorrect handling of the Tab key during XFA form interactions, resulting in...

qemu: out-of-bound heap buffer access via an interrupt ID field

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating...