[SECURITY] Fedora 34 Update: containers-common-1-15.fc34

This package contains common configuration files and documentation for cont ainer tools ecosystem, such as Podman, Buildah and Skopeo. It is required because the most of configuration files and docs come from p rojects which are vendored into Podman, Buildah, Skopeo, etc. but they are not pack ag...

CVE-2021-21394 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party...

Will Google’s Privacy Sandbox take the bite out of tracking cookies?

Third-party cookies have been the lynchpin of online advertising for many years. Plans to phase cookies out forever continue to run at a steady pace, with Google in the driving seat. In 2019, it announced its vision for a “Privacy Sandbox”. The building blocks for this were essentially: 1. Most...

125softnlp (0.0.1), a2 (>=0.10.11, <=0.10.13) +4965 more potentially affected by unknown CVE via tensorflow (>=1.0.1, <=2.21.0)

tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.10.11, =0.5.0, =0.1.6, =1.0.0, =2.0.0, =1.0.0, =0.0.1, =0.0.7 and more Source cves: unknown CVE Source advisory: OSV:OSV-2021-449...

PYSEC-2021-132

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

[SECURITY] Fedora 33 Update: containers-common-1-4.fc33

This package contains common configuration files and documentation for cont ainer tools ecosystem, such as Podman, Buildah and Skopeo. It is required because the most of configuration files and docs come from p rojects which are vendored into Podman, Buildah, Skopeo, etc. but they are not pack ag...

Malvertisers Exploited WebKit 0-Day to Redirect Browser Users to Scam Sites

A malvertising group known as "ScamClub" exploited a zero-day vulnerability in WebKit-based browsers to inject malicious payloads that redirected users to fraudulent websites gift card scams. The attacks, first spotted by ad security firm Confiant in late June 2020, leveraged a bug CVE-2021–1801...

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

From March to December 2020, we tracked segments of a dynamically generated email infrastructure that attackers used to send more than a million emails per month, distributing at least seven distinct malware families in dozens of campaigns using a variety of phishing lures and tactics. These...

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

From March to December 2020, we tracked segments of a dynamically generated email infrastructure that attackers used to send more than a million emails per month, distributing at least seven distinct malware families in dozens of campaigns using a variety of phishing lures and tactics. These...

@sap/grunt-sapui5-bestpractice-build (>=1.3.17, <=1.4.11), @sap/grunt-sapui5-bestpractice-test (>=0.0.1, <=2.0.3) +19 more potentially affected by CVE-2021-21316 via less-openui5 (>=0.1.0, <=0.9.0)

less-openui5 NPM version =0.1.0, =1.3.17, =0.0.1, =1.0.2, =0.0.12, =0.0.8, =0.0.1, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =1.0.42, =0.1.0, =0.1.0, =1.0.0-beta.1, =1.2.0 and more Source cves: CVE-2021-21316 Source advisory: OSV:GHSA-3CRJ-W4F5-GWH4...

amethyst_nphysics (>=0.0.1, <=0.2.0), arci-urdf-viz (>=0.0.1, <=0.1.0) +52 more potentially affected by unknown CVE via ncollide3d (>=0.15.4, <=0.33.0)

ncollide3d CARGO version =0.15.4, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.3.0, =0.12.0, =0.2.0, =0.2.0, =0.3.0, =0.2.0, =0.2.2 - f3lsurface 0.2.0 - fere 0.0.0 - fere-common 0.0.0 - fere-resources 0.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0150...

addr2line (0.6.0), backtrace (>=0.3.6, <=0.3.9) +11 more potentially affected by CVE-2021-25901 via lazy-init (>=0.1.1, <=0.3.0)

lazy-init CARGO version =0.1.1, =0.3.6, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-25901 Source advisory: OSV:RUSTSEC-2021-0004...

Penguin Gaming has a dll hijacking vulnerability (CNVD-2021-11799)

Penguin Gaming is a mobile gaming platform under Tencent. It is located in the "connector" of the e-sports ecosystem, integrating the resources of Tencent.com, QQ Hand Games and Tencent Hublot, and cooperating in depth with professional e-sports events such as QGC and TGA. Penguin Gaming has a dl...

Important: Red Hat Security Advisory: Red Hat Ceph Storage 4.2 security and bug fix update

An update is now available for Red Hat Ceph Storage 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...

Feds Issue Recommendations for Maritime Cybersecurity

The White House has released cybersecurity guidance for securing the Maritime Transportation System MTS, which operates along 25,000 miles of coastal and inland waterways in the United States. The document points out that the MTS encompasses “361 ports, 124 shipyards, more than 3,500 maritime...

Software Supply Chain Attacks: From Formjacking to Third Party Code Changes

2020 wasn’t the first year in which software supply chain attacks caused major damage, but it certainly brought them to the general public. Much has been said about the headline-grabbing nation state examples, but there is a wide spectrum of these attacks and some are commoditized. Protecting...

ifinfo (0.1.0), prosafe_exporter (>=0.1.1, <=0.2.7) potentially affected by unknown CVE via interfaces2 (0.0.5)

interfaces2 CARGO version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on interfaces2 and may be impacted: - ifinfo 0.1.0 - prosafeexporter =0.1.1, =0.2.7 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0002...

Dark Web Pricing Skyrockets for Microsoft RDP Servers, Payment-Card Data

Cybercriminals are vying for Remote Desktop Protocol RDP access, stolen payment cards and DDoS-for-Hire services, based on a recent analysis of underground marketplace pricing. During the COVID-19 pandemic, cybercriminals have profited with “increasingly advantageous positions to benefit from the...

[SECURITY] Fedora 33 Update: matrix-synapse-1.24.0-1.fc33

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

[SECURITY] Fedora 32 Update: matrix-synapse-1.24.0-1.fc32

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...