Automattic: GET /api/v2/url_info endpoint is vulnerable to Blind SSRF

Summary: GET /api/v2/urlinfo endpoint is vulnerable to Blind SSRF. I am able to hit both Internal and External services via url parameter by replacing with internal and external url. Platforms Affected: https://www.tumblr.com/ Steps To Reproduce: 1. Login to https://www.tumblr.com/ 2. Follow any...

EDR in block mode stops IcedID cold

We are happy to announce the general availability of endpoint detection and response EDR in block mode in Microsoft Defender for Endpoint. EDR in block mode turns EDR detections into real-time blocking of malicious behaviors, malware, and artifacts. It uses Microsoft Defender for Endpoint’s...

SUSE SLES12 Security Update : clamav (SUSE-SU-2020:3729-1)

This update for clamav fixes the following issues : clamav was updated to 0.103.0 to implement jscECO-3010 and bsc1118459. clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. -...

ASUS RT-AX86U suffers from a buffer overflow vulnerability

The ASUS RT-AX86U is a wireless router. A buffer overflow vulnerability exists in the ASUS RT-AX86U. The vulnerability stems from the RT-AX86U failing to limit the length of parameters when handling the Blockingrequest service in the httpd service, which can be exploited by an attacker to cause a...

CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

DNS Filtering: A Top Battle Front Against Malware and Phishing

Peter Lowe With the proliferation of malicious websites, domain name system DNS filtering has been adopted as an effective method for blacklisting content and blocking out suspicious webpages. Peter Lowe, security researcher with DNSFilter, talks to Cody Hackett on this week’s Threatpost Podcast...

[SECURITY] Fedora 32 Update: nodejs-12.18.4-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

DEBIAN-CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

UBUNTU-CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Pear Archive_Tar Code Issue Vulnerability

Pear ArchiveTar is a Php-based software from the Pear PEAR team that can perform creation, extraction, etc. on tarballs. A security vulnerability exists in ArchiveTar version 1.4.10 and earlier versions that allows deserialization attacks because phar: is blocked while phar: is not...

Ghostery’s Making a Privacy Browser—and Ad-Free Search Engine

The tracker-blocking company will soon launch a privacy-friendly desktop browser as well...

X (Formerly Twitter): Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links

Summary: A chain of two open redirects on analytics.twitter.com and twitter.com, coupled with the use of an Ideographic Full Stop allows an attacker to defeat Twitter's approach to blocking links. Description: Twitter maintains a deny list of domain names and prevents users from tweeting direct o...

Medium: libvirt

Issue Overview: A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest, where it holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the libvirt daemon...

Cross site scripting

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings...

CVE-2020-25673

A vulnerability was found in Linux kernel where non-blocking socket in llcpsockconnect leads to leak and eventually hanging-up the system...

CVE-2020-25673

A vulnerability was found in Linux kernel where non-blocking socket in llcpsockconnect leads to leak and eventually hanging-up the system...

UBUNTU-CVE-2020-25673

A vulnerability was found in Linux kernel where non-blocking socket in llcpsockconnect leads to leak and eventually hanging-up the system...

async-mutex (>=1.0.1 <=1.4.1), blocking-permit (>=0.1.0 <=1.2.1) +18 more potentially affected by CVE-2020-35915 via futures-intrusive (>=0.2.2 <=0.3.1)

futures-intrusive CARGO version =0.2.2, =1.0.1, =0.1.0, =0.4.0, =0.4.0, =0.4.0, =0.2.0, =0.10.0, =0.3.6, =0.3.7 - raii-counter-futures =0.1.0 - stm32f1xx-futures =0.1.0 - switchyard =0.1.0 and more Source cves: CVE-2020-35915 Source advisory: OSV:RUSTSEC-2020-0072...

CVE-2020-5932

On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting XSS vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed wh...