CVE-2018-5968

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist...

CVE-2018-5968

CVE-2018-5968 concerns FasterXML jackson-databind deserialization. The entry notes unauthenticated remote code execution via two gadgets that bypass a blacklist, stemming from an incomplete fix for CVE-2017-7525 and CVE-2017-17485. Connected sources specify affected jackson-databind versions and ...

CVE-2018-5968

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist...

Meltdown and Spectre Aren’t Business as Usual

The new year brought a new vulnerability type — the CPU-based Meltdown and Spectre bugs — that’s forcing vendors and IT departments to modify long-standing ways of identifying threats, prioritizing remediation, managing patches and evaluating risk. “Meltdown and Spectre are different...

The vulnerability of Cisco’s product update mechanisms on the Cisco Voice Operating System allows a hacker to gain unauthorized access to devices.

The vulnerability of Cisco’s product update mechanisms on the Cisco Voice Operating System is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to devices with root privileges using a...

The vulnerability of the NVIDIA graphics processor driver for the Linux operating system allows a hacker to execute arbitrary code.

The vulnerability of NVIDIA’s graphics driver gm20bclkthrotsetcdevstate in the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within a privileged process...

Learning Orange Education App Has Multiple Vulnerabilities

Learn Orange Education App is a mobile online learning application. There are arbitrary user registration, arbitrary user login and arbitrary user password reset vulnerabilities in XUOE APP. An attacker can register any account, log in to other users' systems, and reset any password by capturing...

Fedora 27 : xen (2017-333ea49a63)

xen: various flaws 1490884 Missing NUMA node parameter verification XSA-231, CVE-2017-14316 Missing check for grant table XSA-232, CVE-2017-14318 cxenstored: Race in domain cleanup XSA-233, CVE-2017-14317 insufficient grant unmapping checks for x86 PV guests XSA-234, CVE-2017-14319 Note that...

Fedora 27 : xen (2017-c432db2971)

xen: various flaws 1501391 multiple MSI mapping issues on x86 XSA-237 DMOP map/unmap missing argument checks XSA-238 hypervisor stack leak in x86 I/O intercept code XSA-239 Unlimited recursion in linear pagetable de-typing XSA-240 Stale TLB entry due to page type release race XSA-241 page type...

Meltdown and Spectre fallout: patching problems persist

Last week, the disclosure by multiple teams from Graz and Pennsylvania University, Rambus, Data61, Cyberus Technology, and Google Project Zero of vulnerabilities under the aliases Meltdown and Spectre rocked the security world, sending vendors scurrying to create patches, if at all possible, and...

WhatsApp Downplays Damage of a Group Invite Bug

Research that claims WhatsApp’s group messaging feature can be compromised by an attacker is being called into question by WhatsApp and the developer of the underlying messaging technology. Last week, a team of researchers from Germany’s Ruhr University Bochum released an academic paper outlining...

Microsoft Releases Patches for 16 Critical Flaws, Including a Zero-Day

If you think that only CPU updates that address this year's major security flaws—Meltdown and Spectre—are the only ones you are advised to grab immediately, there are a handful of major security flaws that you should pay attention to. Microsoft has issued its first Patch Tuesday for 2018 to addre...

Anti-Virus Updates Required Ahead of Microsoft’s Meltdown, Spectre Patches

Microsoft said it is holding off delivering security updates to Windows PCs for Spectre and Meltdown CPU flaws until hosted anti-virus software confirms it does not make unsupported calls into Windows kernel memory. Affected are PCs running certain AV products that bypass Windows built-in Kernel...

Vulnerability Spotlight: Multiple Vulnerabilities in the CPP and Parity Ethereum Client

Vulnerabilities discovered by Marcin Noga of Cisco Talos. Overview Talos is disclosing the presence of multiple vulnerabilities in the CPP and the Parity Ethereum clients. TALOS-2017-0503 / CVE-2017-14457 describes a denial of service vulnerability and potential memory leak in libevm. The functio...

Scary Chip Flaws Raise Spectre of Meltdown

Apple, Google, Microsoft and other tech giants have released updates for a pair of serious security flaws present in most modern computers, smartphones, tablets and mobile devices. Here's a brief rundown on the threat and what you can do to protect your devices. At issue are two different...

How to Protect your Device from Meltdown and Spectre?

By Waqas The devastating discovery about security flaws namely Meltdown and Spectre This is a post from HackRead.com Read the original post: How to Protect your Device from Meltdown and Spectre?...

January 5, 2017 – Morning Cyber Coffee Headlines – “Monopoly” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 5, 2018 - Headlines Carbon Black in the News: Cybersecurity news round-...

January 4, 2017 – Morning Cyber Coffee Headlines – “Scrabble” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 4, 2018 - Headlines Carbon Black in the News: Ransomware: The Problem...

Microsoft Windows Multiple Vulnerabilities (KB4056893)

This host is missing a critical security update according to Microsoft KB4056893 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Meltdown and Spectre CPU Flaws Affect Intel, ARM, AMD Processors

Unlike the initial reports suggested about Intel chips being vulnerable to some severe ‘memory leaking’ flaws, full technical details about the vulnerabilities have now been emerged, which revealed that almost every modern processor since 1995 is vulnerable to the issues. Disclosed today by Googl...