Is API Security on Your Radar?

With the growth in digital transformation, the API management market is set to grow by more than 30% by the year 2025 as more businesses build web APIs and consumers grow to rely on them for everything from mobile apps to customized digital services. As part of strategic business planning, an API...

CVE-2021-42324

An issue was discovered on DCN Digital China Networks S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell...

CVE-2021-42324

The CVE-2021-42324 issue affects DCN S4600-10P-SI switches (pre-R0241.0470). Root cause: improper parameter validation in the console interface. An authenticated, low-privilege attacker can escape the sandbox and execute system commands as root via shell metacharacters in the capture command para...

Digital China Networks S4600-10P-SI 操作系统命令注入漏洞

The Digital China Networks S4600-10P-SI is a switch from Digital China Networks Beijing Co. A security vulnerability exists in DCN Digital China Networks S4600-10P-SI versions prior to R0241.0470, which stems from incorrect validation of parameters in the console interface. An authenticated,...

SUSE SLED12: libreoffice / libreoffice-base / etc (SUSE-SU-2022:1093-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1093-1 advisory. Update to version 7.2.5.1 jscSLE-18213: - CVE-2021-25636: Fixed an incorrect validation of digitally signed documents...

5 ways to spring clean your security

It is now officailly spring in the Northern Hemisphere, and with spring and the longer days comes the inescapable urge to shake off the lethargy of Winter and embrace the need to go through your stuff, throw a bunch of it out, and give the rest of it a shiny new lustre. And in our increasingly...

SUSE-SU-2022:1093-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Update to version 7.2.5.1 jscSLE-18213: - CVE-2021-25636: Fixed an incorrect validation of digitally signed documents bsc1196456...

多款Qualcomm产品资源管理错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuitry including primarily semiconductor devices, but also passive components, etc., and from time to time fabricated on the surface of semiconductor wafers. A resource management error vulnerability exists in sever...

fe-en.ner-stgv2.deltatre.digital Cross Site Scripting vulnerability OBB-2461847

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ukrainian Companies Targeted by Wipers - Impact & Prevention

War, weapons, and wipers By Max Kersten · March 31, 2022 In the recent weeks, Ukrainian companies have been targeted by wipers, likely created by pro-Russian actors. There has been a lot of talk about a “cyber war” and the usage of “cyber weapons.” Whereas the digital domain is certainly abused,...

Ukrainian Companies Targeted by Wipers - Impact & Prevention

War, weapons, and wipers By Max Kersten · March 31, 2022 In the recent weeks, Ukrainian companies have been targeted by wipers, likely created by pro-Russian actors. There has been a lot of talk about a “cyber war” and the usage of “cyber weapons.” Whereas the digital domain is certainly abused,...

Western Digital G-RAID 4/8 代码问题漏洞

Western Digital G-RAID 4/8 is a software utility program from Western Digital, Inc. A security vulnerability exists in the G-RAID 4/8 Software Utility setups for Windows that could lead to the execution of arbitrary code in the context of the system user...

Forcing WhatsApp and iMessage to Work Together Is Doomed to Fail

Europe’s Digital Markets Act requires interoperability between popular messaging apps. But experts warn encryption could be compromised...

3 steps to secure your multicloud and hybrid infrastructure with Azure Arc

As businesses around the world grapple with the growth of an industrialized, organized attacker ecosystem, the need for customers to secure multicloud and hybrid infrastructure and workloads is increasingly urgent. Today, organizations face an attacker ecosystem that is highly economically...

A Fast and Seamless Gaming Experience for Gameloft

Gameloft is a leading gaming provider with more than 20 years of history. The company, created in 2000, has a passion for games and a desire to distribute them to even more players around the world. By bringing the wonders of games to mobile devices and, now, to all digital platforms, Gameloft ha...

The Future of Digital Cash Is Not on the Blockchain

If you want the privacy of paper money, you need something that leaves no paper trail...

Telling stories securely, with Runa Sandvik: Lock and Code S03E07

In 2017, a former NSA contractor named Reality Winner was arrested for allegedly leaking an internal report to the online news outlet The Intercept. To verify the report itself, a journalist for The Intercept sent an image of the report to the NSA, but upon further inspection, it was revealed tha...

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

The plugin does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...

Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed PoC Create/edit a Download and put the following payload in the File Name field: Download...

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

The plugin does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack PoC...