Google, Apple, and Microsoft step hand in hand into a passwordless future

While we recently "celebrated" World Password Day, almost every security outlet keeps telling us that passwords alone are not enough. In practice, in the last few years this has meant pairing passwords with something else, such as a one-time code from an app or an SMS message, in a scheme called...

Over 50 countries sign the “Declaration for the Future of the Internet”

Governments of the US, EU member states, and 32 other countries have announced the launch of the "Declaration for the Future of the Internet," a "political commitment" among endorsers "to advance a positive vision for the internet and digital technologies." "We are united by a belief in the...

Recorded Future: Storage of old passwords in plain text format

Summary: Server response from app.recordedfuture.com has old passwords for a logged in account in plain text format. Storage of passwords in any readable format or using weak hashes put the account or system at great risk. What's interesting is how RecordedFuture store multiple passwords not just...

Recent Mobile Payment Trends And How They Are Shaping The Future

By Owais Sultan Consumers, retailers, banks, and payment processors form a complicated network in todays payment processing environment. Recently, there has… This is a post from HackRead.com Read the original post: Recent Mobile Payment Trends And How They Are Shaping The Future...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at Future Summits in Antwerp, Belgium, on May 18, 2022. I’m speaking at IT-S Now 2022 in Vienna, Austria, on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn,...

[WP-H5] yVault.sol A malicious early user/attacker can manipulate the vault's pricePerShare to take an unfair share of future users' deposits

Lines of code Vulnerability details function deposituint256 amount public noContractmsg.sender requireamount 0, "INVALIDAMOUNT"; uint256 balanceBefore = balance; token.safeTransferFrommsg.sender, addressthis, amount; uint256 supply = totalSupply; uint256 shares; if supply == 0 shares = amount; el...

CVE-2022-28205

An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future...

PT-2022-18874 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.37.1 Description: An issue was discovered in the CentralAuth extension, which mishandles a ttl issue for groups expiring in the future. Recommendations: For MediaWiki versions through 1.37.1, update to a version...

CVE-2022-24782

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...

Upcoming Speaking Events

This is a current list of where and when I am scheduled to speak: I’m participating in an online panel discussion on “Ukraine and Russia: The Online War,” hosted by UMass Amherst, at 5:00 PM Eastern on March 31, 2022. I’m speaking at Future Summits in Antwerp, Belgium on May 18, 2022. I’m speakin...

GHSA-PVX3-GM3C-GMPR Denial of Service in Go-Ethereum

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service DoS...

Design/Logic Flaw

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service DoS...

PT-2022-15930

Name of the Vulnerable Software and Affected Versions Go-Ethereum versions 1.10.12 and older Description A design flaw allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing...

Creating a More Diverse Tech Future with the Akamai Foundation

2021, a year of creating a more diverse tech future with The Akamai Foundation...

CVE-2016-9007

IBM UrbanCode Deploy contains a vulnerability (CVE-2016-9007) where secure property values can be leaked via process execution log output, potentially exposing sensitive data to unauthorized users. Affected versions include IBM UrbanCode Deploy 6.1.x (various subversions) and 6.2.x (up to 6.2.2.1...

CVE-2017-1547

CVE-2017-1547 affects IBM Emptoris Services Procurement. The vulnerability enables username enumeration through the forgot-password flow, allowing an attacker to determine valid usernames and potentially brute-force credentials. This concerns IBM Emptoris Services Procurement 10.0.0.x. Root cause...

CVE-2012-0424

Technical details for CVE-2012-0424 are not provided in the supplied documents; the Initial Description is a placeholder. Monitor for updates from the sources.

CVE-2021-26976

Technical details for CVE-2021-26976 are not publicly available in the provided documents. Monitoring for updates is advised; no affected products, impact, or remediation are described in the supplied materials.

CVE-2022-24087

CVE-2022-24087 is the follow-on to CVE-2022-24086, an Improper Input Validation vulnerability in Adobe Commerce/Magento Open Source that enables pre-authenticated remote code execution. Connected sources indicate it affects Magento Open Source/Adobe Commerce 2.3.3-p1–2.3.7-p2 and 2.4.0–2.4.3-p1, ...

CVE-2099-1234

Technical details for CVE-2099-1234 are not publicly available in the provided documents. Monitor for updates; no affected products, vectors, or remediation information can be stated at this time.