Google Project Zero Cuts Bug Disclosure Timeline to a 30-Day Grace Period

Google Project Zero will now give organizations a 30-day grace period to patch zero-day flaws it discovers in a new disclosure policy revealed this week aimed at speeding up the time it takes for patches to be adopted. Known for discovering a number of high-profile zero days—in Google’s own...

Severe Bugs Reported in EtherNet/IP Stack for Industrial Systems

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday issued an advisory warning of multiple vulnerabilities in the OpENer EtherNet/IP stack that could expose industrial systems to denial-of-service DoS attacks, data leaks, and remote code execution. All OpENer commits and...

Vulnerabilities fixed in SUSE Linux Enterprise kernel

SUSE developers have fixed several vulnerabilities in the Linux kernel as used in SUSE Linux Enterprise. The vulnerabilities potentially enable a local malicious person to execute attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Apr 2021)

This host is missing a critical security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft Edge (Chromium-Based) Multiple Vulnerabilities (Apr 2021)

This host is missing an important security update according to Microsoft Edge Chromium-Based updates. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

The vulnerability of the cmd.exe command-line interpreter of the Windows operating system allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the cmd.exe command-line interpreter of the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause service interruptions...

USN-4910-1 linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities

Ryota Shiga discovered that the sockopt BPF hooks in the Linux kernel could allow a user space program to probe for valid kernel addresses. A local attacker could use this to ease exploitation of another kernel vulnerability. CVE-2021-20239 It was discovered that the BPF verifier in the Linux...

USN-4904-1 linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities

Ben Harris discovered that the Linux kernel would strip extended privilege attributes of files when performing a failed unprivileged system call. A local attacker could use this to cause a denial of service. CVE-2015-1350 Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PV...

100M More IoT Devices Are Exposed—and They Won’t Be the Last

The Name:Wreck flaws in TCP/IP are the latest in a series of vulnerabilities with global implications...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2021-1741)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the administration interface of the VMware Carbon Black Cloud Workload security platform allows a perpetrator to increase their privileges.

The vulnerability of the administration interface of the VMware Carbon Black Cloud Workload security platform is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

The vulnerability of the Zero Touch Provisioning (ZTP) service for managing VoIP devices in the software-based IP telephones of Poly VVX, CCX, and Trio allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Zero Touch Provisioning ZTP service for VoIP device management in the software-based IP telephones of Poly VVX, CCX, and Trio is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access...

The vulnerability in the web interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection systems allows a perpetrator to perform cross-site scripting (XSS) attacks.

The vulnerability in the web interface for managing Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor...

EUVD-2021-11133

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...

Windows, Ubuntu, Zoom, Safari, MS Exchange Hacked at Pwn2Own 2021

The 2021 spring edition of Pwn2Own hacking contest concluded last week on April 8 with a three-way tie between Team Devcore, OV, and Computest researchers Daan Keuper and Thijs Alkemade. A total of $1.2 million was awarded for 16 high-profile exploits over the course of the three-day virtual even...

CVE-2021-1472

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details...

CVE-2021-1407

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, Cisco Unified Communications Manager Session Management Edition Unified CM SME, and Cisco Unity Connection...

The vulnerabilities of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud antivirus protection systems are related to authentication mechanism flaws, which allow attackers to trigger service denial-of-service attacks.

The vulnerabilities of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud are related to deficiencies in the authentication mechanism. Exploiting these vulnerabilities can allow attackers to trigger a service...

Vulnerabilities fixed in Python

Vulnerabilities have been fixed in Python. The vulnerabilities allow a malicious person to obtain sensitive data. This security advisory addresses two OpenSSL vulnerabilities that also appear in security advisory NCSC-2021-0259. For this reason, they are not included in the probability damage...

OpenIAM 安全漏洞

OpenIAM is a fully integrated identity and access management platform. Vulnerabilities exist in OpenIAM versions prior to 4.2.0.3 due to access control errors in the "Create User", "Modify User Privileges" and "Password Reset" operations. No details of the vulnerabilities are available at this ti...