[Security Nation] Kate Stewart on Open-Source Projects at the Linux Foundation

!\Security Nation\ Kate Stewart on Open-Source Projects at the Linux Foundationhttps://blog.rapid7.com/content/images/2022/04/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Kate Stewart, VP of Dependable Embedded Systems at the Linux Foundation, about the...

Google Chrome Developer Tools Bypass

The vulnerability of Google Chrome’s developer tools relates to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created web page...

KLA12505 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Visual Studio can be...

Google Chrome Permission Permissions and Access Control Vulnerabilities

Google Chrome is a web browser from Google, Inc. and V8 is an open source JavaScript engine. Google Chrome suffers from a privilege permission and access control issue vulnerability that stems from insufficient policy enforcement in the software's developer tools...

Gateway page stuck after authentication on Chrome browser v100

- Citrix Gateway integration with Storefront -Custom Themes based on RFWEBUI, but may appear with others too - Observed at CVPN and Regular Storefront Integrations. -Chrome Version updated to 100.0.4896.60 Official Build 64-bit or later triggers the issue. - Page is stuck spinning circle...

CVE-2021-39780

In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-39780

In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-39780

In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

Input validation

In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-39780

CVE-2021-39780 affects Android 12L Traceur: a missing permission check allows bypassing developer settings to capture system traces, enabling local privilege escalation with user interaction required. The Android 12L security release notes indicate this issue is addressed in Android 12L; devices ...

Welcome to Edge Diagnostics

After more than a year of dedication and hard work, we are delighted to officially announce the launch of our new Edge Diagnostics application on March 30, 2022. Diagnosing network and content issues quickly and effectively is critical to your success! Therefore the aim is to make the existing...

Spring Cloud Azure 4.0 is Now Generally Available

NOTE: Hi, Spring fans! This is a guest post from Sean Li, our friend at Microsoft I am pleased to announce that Spring Cloud Azure 4.0 is now generally available. With this major release we aim to bring better security, leaner dependencies, support for production readiness and more. Version 4...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from a lack of privilege checks in Traceur that could bypass developer setup requirements to capture system traces. An attacker could exploi...

KONGA elevation of privilege vulnerability

KONGA is a full-featured open source, multi-user GUI from Dutch individual developer Panagis Tselentis. version 0.14.9 of KONGA contains an elevation of privilege vulnerability that could be exploited by attackers to gain full administrative access...

QingScan Cross-Site Script Vulnerability

QingScan is a batch vulnerability mining tool by a Chinese daxia individual developer. It is used to glue various good scanners. There is a security vulnerability in QingScan 1.3.0, there is no information about the vulnerability at the moment, please feel free to pay attention to CNNVD or vendor...

Design/Logic Flaw

A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user typically a developer manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2...

An update on Java 17+ adoption

As a follow-up to my blog post from last years SpringOne, it is time for an update on our Java 17+ baseline efforts! We established the new baseline on our main branches, with a few milestones out already. The feedback has been very positive, not only in terms of framework improvements but also i...

Security Bulletin: NVIDIA CUDA Toolkit - March 2022

NVIDIA has released a software update for NVIDIA® CUDA® Toolkit software. This update addresses security issues that may lead to code execution, denial of service, or information disclosure. To protect your system, download and install this software update from the CUDA Toolkit Downloads page. Go...

Ostorlab - A Security Scanning Platform That Enables Running Complex Security Scanning Tasks Involving Multiple Tools In An Easy, Scalable And Distributed Way

The Sales Pitch If this is the first time you are visiting the Ostorlab Github page, here is the sales pitch. Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the...

Marky injection vulnerability

Marky is a Markdown editor by Alessandro Arnodo, a Swiss individual developer. Marky suffers from an injection vulnerability that allows an attacker to execute arbitrary code by injecting a carefully crafted attack payload...