The vulnerability of C and C++ garbage collectors using Boehm-Demers-Weiser GC allows a intruder to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of garbage collectors in C and C++ languages, such as Boehm-Demers-Weiser GC, involves the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to gain access to confidential data, compromise its integrity, and ev...

Facebook users sue Meta for allegedly building "secret workaround" to Apple privacy safeguards

Last week, two Facebook users filed a class-action complaint against Meta in San Francisco's federal court, alleging the company built a "secret workaround" to Apple's safeguards that protect iPhone users from tracking. Facebook circumvents Apple's privacy rules by opening in-app browsers within...

How to Advocate for Data Privacy and Users' Rights

Want to speak up against Big Tech, unjust data collection, and surveillance? Here's how to be an activist in your community and beyond...

Security Bulletin: Vulnerability in IBM SPSS Data Collection due to issues in Eclipse Help System (CVE-2013-0464, CVE-2013-0467)

Abstract The version of IBM Eclipse Help System that is shipped with IBM SPSS Data Collection versions 6.0, 6.0.1 "Data Collection" and 7.0 has multiple security vulnerabilities. These vulnerabilities allow attackers to perform cross-site scripting and source code disclosure attacks. Content...

OTFCC 安全漏洞

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A denial of service vulnerability exists in Caryll OTFCC, which originates from a segmentation conflict at /release-x64/otfccdump+0x6babea. An attacker can exploit the vulnerability t...

Remote Control Collection RCE

This module utilizes the Remote Control Server's, part of the Remote Control Collection by Steppschuh, protocol to deploy a payload and run it from the server. This module will only deploy a payload if the server is set without a password default. Tested against 3.1.1.12, current at the time of...

This Week in Spring - September 13th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Weve got a lot of good stuff to get to so lets dive right into it! A Bootiful Podcast: Hashicorps Rosemary Wang on securing the intersection of apps and ops with Hashicorp Vault a nice video by my colleague Dan Vega: Spring...

GHSA-5FFJ-MPH5-C5HV Appwrite Vulnerable to Cross-site Scripting

Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names...

Appwrite Vulnerable to Cross-site Scripting

Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names...

PT-2022-37266 · Apache · Apache Commons Configuration2

Name of the Vulnerable Software and Affected Versions: Apache Commons Configuration2 affected versions not specified Description: The issue is related to a security exception in the java.util.Collections$UnmodifiableCollection.forEach method, which is called by...

apache-commons-configuration:XMLConfigurationWriteFuzzer: Security exception in java.base/java.util.Collections$UnmodifiableCollection.forEach

Detailed Report: https://oss-fuzz.com/testcase?key=4903512403738624 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: XMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

The art and science behind Microsoft threat hunting: Part 1

At Microsoft, we define threat hunting as the practice of actively looking for cyberthreats that have covertly or not so covertly penetrated an environment. This involves looking beyond the known alerts or malicious threats to discover new potential threats and vulnerabilities. Why do incident...

CVE-2022-2806

It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el86, ovirt-log-collector-4.4.7-2.el8ev...

themonarchcollection.com Cross Site Scripting vulnerability OBB-2883668

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GCC 安全漏洞

GCC is a collection of GNU compilers. It is primarily used to compile the C and C++ languages. A security vulnerability exists in GCC, which stems from an internal compiler error in the matchreload function in lra-constraints.c that causes the input file to crash...

Gcc 安全漏洞

GCC is a collection of GNU compilers. It is mainly used to compile the C and C++ languages. A security vulnerability exists in Gcc. An attacker has exploited this vulnerability to cause g++ to crash during compilation via a specially crafted input source file...

PT-2022-19693 · Qualys · Qualys Cloud Agent

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent version 4.8.0-49 Description: An issue was discovered in Qualys Cloud Agent where it writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may unexpectedly write credentials from environmen...

Malicious creator can create different NFT drop collections with NFTs that will be revealed to correspond to same ipfs token URI

Lines of code Vulnerability details Impact The following createNFTDropCollection function with different name, symbol, and nonce can be called to create different NFT drop collections. function createNFTDropCollection string calldata name, string calldata symbol, string calldata baseURI, bytes32...

Important: Red Hat Security Advisory: Service Telemetry Framework 1.4 security update

An update is now available for Service Telemetry Framework 1.4 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

IDOR allows to create new collection or modify a existing one

Description A normal user can create a new collection with the provided book ids or add new books to an existing collection, whose operations should be only executed by the administrator. \ \ This is possible due to an missing administrative role check in the /api/collection/update-for-series API...