CVE-2021-25958

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

MGASA-2021-0410 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.10.60 and fixes at least the following security issues: A missing validation of the "intctl" VMCB field allows a malicious L1 guest to enable AVIC support Advanced Virtual Interrupt Controller for the L2 guest. The L2 guest is able to write to a...

OESA-2021-1321 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: curl supports the -t command line option, known as CURLOPTTELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pai...

COVID-19 Contact-Tracing Data Exposed, Fake Vax Cards Circulate

This week, the Indiana Department of Health issued a notice that the state’s COVID-19 contact-tracing system had been exposed via a cloud misconfiguration, revealing names, emails, gender, ethnicity, race and dates of birth of more than 750,000 people. The incident shows that COVID-19 data could ...

PT-2021-5760 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: The issue is related to an out-of-bounds read in the ntfs ie lookup function of the NTFS-3G driver for the FUSE module. This can be exploited by a crafted NTFS image, potentially allowing an...

Mozilla Thunderbird Security Advisories (MFSA2021-35, MFSA2021-36) - Mac OS X

This host is missing a security update according to Mozilla. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird"...

Mozilla Thunderbird Security Advisories (MFSA2021-35, MFSA2021-36) - Windows

This host is missing a security update according to Mozilla. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird"...

CVE-2021-3653

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "intctl" field, this issue could allow a malicious ...

PYSEC-2021-301

TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tens...

IT Giant Accenture Hit by LockBit Ransomware; Hackers Threaten to Leak Data

Global IT consultancy giant Accenture has become the latest company to be hit by the LockBit ransomware gang, according to a post made by the operators on their dark web portal, likely filling a void left in the wake of DarkSide and REvil shutdown. "These people are beyond privacy and security. I...

PT-2021-9102

Name of the Vulnerable Software and Affected Versions Linaro OP-TEE versions prior to 3.7.0 Description The issue allows an attacker to call update and final cryptographic functions directly by using inconsistent or malformed data, potentially causing a crash that could leak sensitive information...

TYPO3 信息泄露漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 has an information disclosure vulnerability that stems from a failure to properly encode user input, which could be exploited by an attacker to obtain sensitive data for API...

CVE-2021-21790

An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet IRP can lead to privileged reads in the context of a driver which can result in sensitive information...

Lead generation firm exposed household data of 63 million Americans

By Waqas The data leak contains email addresses with .gov suffixes or indicated that the user worked for New York Police Department. This is a post from HackRead.com Read the original post: Lead generation firm exposed household data of 63 million Americans...

CVE-2021-30583

Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-30582

Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Elasticsearch 安全漏洞

Elasticsearch is a search engine based on the Lucene library. A security vulnerability in Searchable Snapshots in Elasticsearch versions 7.11.0 through 7.13.4 can be exploited by an attacker to bypass data access restrictions in order to obtain sensitive information...

CVE-2021-20332 MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credential...

PT-2021-3695 · Fetchmail +8 · Fetchmail +8

Name of the Vulnerable Software and Affected Versions: Fetchmail versions prior to 6.4.20 Description: The issue is related to the report vbuild function in report.c, which sometimes omits initialization of the vsnprintf va list argument. This might allow mail servers to cause a denial of service...

The Clubhouse database “breach” is likely a non-breach. Here’s why.

Before the work week ended last week Friday, a security researcher found a leak of what is claimed to be full phone numbers of users of Clubhouse, the new social media app everyone is talking about and just recently came out of beta. Clubhouse is an audio-only social media platform where, unlike...