2786 matches found
@cookiex/class-state (>=0.0.1, <=0.0.2), @cookiex/cli (>=0.2.10, <=0.2.11-0) +3 more potentially affected by CVE-2021-23442 via @cookiex/deep (>=0.0.1, <=0.0.6)
@cookiex/deep NPM version =0.0.1, =0.0.1, =0.2.10, =0.0.0-0.1, =0.1.2, =0.1.3 Source cves: CVE-2021-23442 Source advisory: SNYK:JS-COOKIEXDEEP-1582793...
Prototype Pollution
Overview @cookiex/deep is a Tool to assign properties recursively and create recursion features in an easy way. Affected versions of this package are vulnerable to Prototype Pollution. The global proto object can be polluted using the proto object. PoC var deep = require"@cookiex/deep" const targ...
Researchers Propose Machine Learning-based Bluetooth Authentication Scheme
A group of academics has proposed a machine learning approach that uses authentic interactions between devices in Bluetooth networks as a foundation to handle device-to-device authentication reliably. Called "Verification of Interaction Authenticity" aka VIA, the recurring authentication scheme...
The Underground Economy: Recon, Weaponization & Delivery for Account Takeovers
This is Part I of a two-part blog series taking readers inside the criminal enterprise that is account-takeover fraud. For part II, please click here. With account takeover ATO attacks on the rise, stopping threat actors in the early phases of the kill chain will help today’s defenders gain an...
Uncontrolled recursion in rust-yaml
Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth...
merge-change 软件包安全漏洞
merge-change is an open source simple library for deep merging of objects and other types, also for patching and immutable new. The merge-change package has a security vulnerability that makes the package susceptible to prototype contamination via the utils.set function...
Black Hat: Scaling Automated Disinformation for Misery and Profit
LAS VEGAS – Researchers recently demonstrated the weaponization of deep neural networks that can be used to shape public opinion, enrage people on Twitter and possibly spark QAnon 2.0. The research, presented last week at Black Hat by Drew Lohn, senior fellow at the Center for Security and...
Combing through the fuzz: Using fuzzy hashing and deep learning to counter malware detection evasion techniques
Today’s cybersecurity threats continue to find ways to fly and stay under the radar. Cybercriminals use polymorphic malware because a slight change in the binary code or script could allow the said threats to avoid detection by traditional antivirus software. Threat actors customize their wares...
Combing through the fuzz: Using fuzzy hashing and deep learning to counter malware detection evasion techniques
Today’s cybersecurity threats continue to find ways to fly and stay under the radar. Cybercriminals use polymorphic malware because a slight change in the binary code or script could allow the said threats to avoid detection by traditional antivirus software. Threat actors customize their wares...
In0ri - Defacement Detection With Deep Learning
In0ri is a defacement detection system utilizing a image-classification convolutional neural network. Introduction When monitoring a website, In0ri will periodically take a screenshot of the website then put it through a preprocessor that will resize the image down to 250x250px and numericalize t...
OESA-2021-1268 OpenEXR security update
OpenEXR is a high dynamic-range HDR image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fixes: There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a craft...
The vulnerability of the DeepScanLineInputFile() function in software for storing images with wide dynamic range brightness in OpenEXR, related to memory usage after deallocation, allows a hacker to cause a service failure.
The vulnerability of the DeepScanLineInputFile function in software for storing images in OpenEXR format with a wide dynamic range of brightness levels is related to the use of memory areas after they are freed. Exploiting this vulnerability could allow an attacker to cause a service failure...
Why I Love (Breaking Into) Your Security Appliances
Amid the Colonial Pipeline and JBS ransomware attacks that sparked shockwaves among media worldwide, news broke that attackers were able to compromise Colonial Pipeline through a legacy VPN account. The account lacked multifactor authentication MFA and wasn’t in active use within the business, a...
DEBIAN-CVE-2021-3598
There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability...
record-like-deep-assign code issue vulnerability
record-like-deep-assign is a package. A code issue vulnerability exists in record-like-deep-assign that stems from a prototype contamination affecting key functionality within the plugin. No details of the vulnerability are provided at this time...
CVE-2021-23402
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...
Design/Logic Flaw
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23402
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23402
CVE-2021-23402 affects the npm package record-like-deep-assign. All versions are vulnerable to prototype pollution via the main functionality, as shown in public advisories. The root cause involves unsafe handling of object merges or path-based assignments that can pollute Object.prototype, enabl...
