CVE-2021-34411: Improper Privilege Management

During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privileges. If the installer was launched with elevated privileges such as by SCCM this can result in a local privilege escalation...

Parents and teachers believe digital surveillance of kids outweighs risks

Schools in the US have been using surveillance software to keep an eye on their students, and such software has grown significantly in popularity since the COVD-19 pandemic closed campuses nationwide. And this is fine—at least according to new research released by the Center for Democracy &...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2021-87025)

IBM Sterling File Gateway is a suite of file transfer software from IBM Corporation. The software integrates different file transfer activity centers and helps file-based data to be securely exchanged over the Internet.An information disclosure vulnerability exists in IBM Sterling File Gateway,...

FamousSparrow APT Spies on Hotels, Governments

A cyberespionage group dubbed “FamousSparrow” by researchers has taken flight, targeting hotels, governments and private organizations around the world with a custom backdoor called, appropriately, “SparrowDoor.” It’s one of the advanced persistent threats APTs that targeted the ProxyLogon...

CVE-2021-1620 Cisco IOS and IOS XE Software IKEv2 AutoReconnect Feature Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This vulnerability occurs because the cod...

Cisco IOS and IOS XE Software IKEv2 AutoReconnect Feature Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This vulnerability occurs because the cod...

TikTok, GitHub, Facebook Join Open-Source Bug Bounty

Tech giants want hackers to take their money, in exchange for rooting out critical vulnerabilities lurking in the open-source code they use. As more businesses rely on open-source software for mission-critical infrastructure, HackerOne, along with sponsors including Elastic, Facebook, Figma,...

Cisco多款产品 代码问题漏洞

Cisco IOS XE and Cisco Catalyst 9000 are both products of Cisco, Inc.Cisco IOS XE is an operating system. A single operating system for enterprise wired and wireless access, aggregation, core, and WAN, Cisco IOS XE reduces business and network complexity. The Cisco Catalyst 9000 is a switch. A co...

PT-2021-5608 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description: A vulnerability in the Internet Key Exchange Version 2 IKEv2 support for the AutoReconnect feature could allow an authenticated, remote attacker to...

Internet safety tips for kids and teens: A comprehensive guide for the modern parent

When it comes to picking a new device for your child, its often difficult to know where to start. Whether youre looking for a smartphone, a laptop, a gaming device or something else, or even just signing up for an account online, you want to make sure your kids are protected. Its important to get...

What Is a TCP Three-Way Handshake?

The TCP three-way handshake is one of the critical building blocks of the internet. It facilitates the smooth and consistent flow of information across and among different networks without compromising security...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

ALBA-2021:3573 ca-certificates bug fix and enhancement update

The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. Bug Fixes and Enhancements: Annual 2021 ca-certificates update 2.48 from nss 3.66 for Firefox 91 BZ1971200...

ca-certificates bug fix and enhancement update

The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. Bug Fixes and Enhancements: Annual 2021 ca-certificates update 2.48 from nss 3.66 for Firefox 91 BZ1971200...

Does Your Organization Have a Security.txt File?

It happens all the time: Organizations get hacked because there isnt an obvious way for security researchers to let them know about security vulnerabilities or data leaks. Or maybe it isnt entirely clear who should get the report when remote access to an organizations internal network is being so...

The vulnerability in the `lexer_parse_number` function of the `js-lexer.c` component of the JavaScript engine for Internet of Things applications, JerryScript, and the IoT.js platform, related to buffer overflows, allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the lexerparsenumber function in the js-lexer.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to gain access to confidential dat...

The vulnerability of the `re_parse_char_escape` function in the `re-parser.c` component of the JavaScript Internet of Things scripting engine JerryScript and the IoT.js platform, related to buffer overflow attacks, allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the reparsecharescape function in the re-parser.c component of the JavaScript Internet of Things scripting engine JerryScript and the IoT.js platform is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

The vulnerability of the `ecma_is_lexical_environment` function in the `ecma-helpers.c` component of the JavaScript engine for Things.js and the IoT.js platform, related to memory management after its deallocation, allows a attacker to cause a service failure.

The vulnerability of the ecmaislexicalenvironment function in the ecma-helpers.c component of the JavaScript engine for Things.js and the IoT.js platform is related to the use of memory after it is released. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability in the `parser_parse_expression` function of the `js-parser-expr.c` component of the JavaScript engine for Internet of Things technology, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a malicious actor to trigger a service failure.

The vulnerability of the parserparseexpression function in the js-parser-expr.c component of the JavaScript engine for Internet of Things technology, JerryScript, and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicio...

CVE-2021-1947

Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking...