Greening the Digital Economy

COVID-19 and related quarantine protocols have pushed the world even more online than it already was. Global energy consumption for all things digital has been increasing by about 9% per year between 2015 and 2020, and is tracking to be responsible for about 8% of greenhouse gas GHG emission by...

Default credentials

The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default...

futureocean.org Cross Site Scripting vulnerability OBB-1208624

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

rio allows a use-after-free buffer access when a future is leaked

When a rio::Completion is leaked, its drop code will not run. The drop code is responsible for waiting until the kernel completes the I/O operation into, or out of, the buffer borrowed by rio::Completion. Leaking the struct will allow one to access and/or drop the buffer, which can lead to a...

CVE-2020-11014

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the...

systemd: services with DynamicUser can create SUID/SGID binaries

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...

Enabling Workforce Productivity in Challenging Times

As the world shifts to an increasingly virtual environment, Akamai continues to be at the forefront of helping customers enable workforce productivity with Akamai's Enterprise Application Access and Enterprise Threat Protector. From our detailed offer to our recent Edge Live Virtual Summit, where...

SQL Injection Vulnerability in the Website Building System of Hainan Creative Future Culture and Media Co.

Hainan Creative Future Culture Media Co., Ltd. is engaged in brand one-stop service e-commerce advertising consulting services media enterprises. We design complete solutions for users and provide the best advertising support services. There is a SQL injection vulnerability in the website system ...

Microsoft Patch Tuesday, April 2020 Edition

Microsoft today released updates to fix 113 security vulnerabilities in its various Windows operating systems and related software. Those include at least three flaws that are actively being exploited, as well as two others which were publicly detailed prior to today, potentially giving attackers...

SQL Injection Vulnerability in the Website Building System of Hainan Creative Future Culture Media Co.

Hainan Creative Future Culture Media Co., Ltd. is engaged in brand one-stop service e-commerce advertising consulting services media enterprises. We design complete solutions for users and provide the best advertising support services. There is a SQL injection vulnerability in the website system ...

The Future is Misconfigured

As the world continues to grow more agile and flexible, it is crucial to know the state of the threat landscape. Trend Micro experts’ breakdown insights on current and emerging threats and technologies, with cloud misconfigurations front and center...

CVE-2019-4583

IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289...

Information disclosure

IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289...

At 21 Tbps, reaching new levels of IPv6 traffic!

While setting a new record of 140 Tbps of peak traffic delivered on February 11th, Akamai reached another new milestone in the process: 21 Tbps of peak IPv6 traffic delivered! The global adoption of IPv6 is important to the future of the Internet and Akamai has been committed to helping move IPv6...

At 21 Tbps, Reaching New Levels of IPv6 Traffic

The global adoption of IPv6 is important to the future of the internet and Akamai has been committed to helping move IPv6 deployment forward ever since we launched production IPv6 support in 2012...

CVE-2019-15126 aka Kr00k

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a...

Afternoon Cyber Tea—The State of Cybersecurity: How did we get here? What does it mean?

Every year the number and scale of cyberattacks grows. Marc Goodman, a global security strategist, futurist, and author of the book, Future Crimes: Everything is Connected, Everyone is Vulnerable, and What We Can Do About It, thinks a lot about how we got here and what it means, which is why he w...

Functrace - A Function Tracer

functrace is a tool that helps to analyze a binary file with dynamic instrumentation using DynamoRIO http://dynamorio.org/. These are some implemented features based on DynamoRIO: disassemble all the executed code disassemble a specific function dump if these are addresses get arguments of a...

Apple Explains Mysterious iPhone 11 Location Requests

KrebsOnSecurity ran a story this week that puzzled over Apple's response to inquiries about a potential privacy leak in its new iPhone 11 line, in which the devices appear to intermittently seek the user's location even when all applications and system services are individually set never to reque...

React Prereleases-Preparing for the Future

By Owais Sultan Recently, React has come up with prerelease channels to update users with the latest changes taking place in the React ecosystem. They spoke about this through a blog published on their React website. React relies on an open-source community to report bugs, open pull requests and...