PT-2021-12645 · Mcafee · Mcafee Endpoint Security (Ens) For Windows +1

Name of the Vulnerable Software and Affected Versions: McAfee Endpoint Security ENS for Windows versions prior to 10.7.0 February 2021 Update Description: The issue allows a remote attacker to view requests from ENS and responses from McAfee Global Threat Intelligence GTI servers over DNS. This i...

A Post-Data Privacy World and Data-Rights Management

The reality is that today, almost everyone is being tracked and monitored 24/7 with cameras recording our expressions, interactions and speech to determine what we might be thinking, where we are going and who we are meeting. While privacy differs from nation to nation and culture to culture, one...

CVE-2020-36322

A denial of service flaw was found in fusedogetattr in fs/fuse/dir.c in the kernel side of the FUSE filesystem in the Linux kernel. A local user could use this flaw to crash the system. Mitigation As the FUSE module will be auto-loaded when required, its use can be disabled by preventing the modu...

红帽 Red Hat Ceph 授权问题漏洞

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system without a single point of failure, based on POSIX Portable Operating System Interface, enabling fault-tolerant and seamless data replication. cep...

100M More IoT Devices Are Exposed—and They Won’t Be the Last

The Name:Wreck flaws in TCP/IP are the latest in a series of vulnerabilities with global implications...

CVE-2021-3128

In ASUS RT-AX3000, ZenWiFi AX XT8, RT-AX88U, and other ASUS routers with firmware 3.0.0.4.386.42095 or 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix...

CVE-2021-3125

In TP-Link TL-XDR3230 1.0.12, TL-XDR1850 1.0.9, TL-XDR1860 1.0.14, TL-XDR3250 1.0.2, TL-XDR6060 Turbo 1.1.8, TL-XDR5430 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This...

CVE-2021-23270

In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a...

Code injection

In ASUS RT-AX3000, ZenWiFi AX XT8, RT-AX88U, and other ASUS routers with firmware 3.0.0.4.386.42095 or 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix...

Improper access control

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromi...

CVE-2021-24215

CVE-2021-24215 affects the Controlled Admin Access WordPress plugin (before 1.5.2). It is an improper access control vulnerability allowing unauthenticated attackers to access website customization and global CMS settings (e.g., /wp-admin/customization.php and /wp-admin/options.php), potentially ...

SonicWall Global Management System Command Execution Vulnerability

The SonicWall Global Management System GMS provides a holistic approach to managing the entire network security environment by business process and service level. A command execution vulnerability exists in SonicWall GMS version 9.3. An attacker could exploit the vulnerability to locally elevate...

SonicWall Global Management System 授权问题漏洞

The SonicWall Global Management System GMS provides a holistic approach to managing the entire network security environment by business process and service level. A command execution vulnerability exists in SonicWall GMS version 9.3. An attacker could exploit the vulnerability to locally elevate...

CVE-2020-13592

An exploitable SQL injection vulnerability exists in "globallists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either wi...

SAP Bugs Under Active Cyberattack

Active cyberattacks on known vulnerabilities in SAP systems could lead to full control of unsecured SAP applications, researchers are warning. Adversaries are carrying out a range of attacks, according to an alert from SAP and security firm Onapsis issued Tuesday – including theft of sensitive...

LinkedIn Spear-Phishing Campaign Targets Job Hunters

A threat group called Golden Chickens is delivering the fileless backdoor moreeggs through a spear-phishing campaign targeting professionals on LinkedIn with fake job offers, according to researchers at eSentire. The phishing emails try to trick a victim into clicking on a malicious .ZIP file by...

Qualcomm 芯片 资源管理错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc. and from time to time fabricated on the surface of semiconductor wafers. A security vulnerability exists in the Qualcomm GPS HLOS driver that...

OSV-2021-594 Global-buffer-overflow in read_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32791 Crash type: Global-buffer-overflow READ 1 Crash state: readcodingunit readcodingquadtree readcodingquadtree...

Financial Cyberthreats in 2020

2020 was challenging for everyone: companies, regulators, individuals. Due to the limitations imposed by the epidemiological situation, particular categories of users and businesses were increasingly targeted by cybercriminals. While we were adjusting to remote work and the rest of the new...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...