38663 matches found
CVE-2022-39873
Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...
Hardcoded credentials
FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the...
FlyteAdmin 信任管理问题漏洞
FlyteAdmin is a control plane for Flyte open source. Responsible for managing entities tasks, workflows, startup plans and managing workflow execution. An information disclosure vulnerability exists in Flyte FlyteAdmin versions prior to 1.1.44, which stems from the fact that users who enable the...
PT-2022-6440 · Linux +8 · Linux Kernel +8
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is caused by synchronization errors when using a shared resource in the implementation of the IPv6 protocol in the Linux kernel. This can be exploited by a remote attacker to...
PT-2022-26060 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.8 MediaWiki versions 1.36.x through 1.37.4 MediaWiki versions 1.38.x through 1.38.2 Description: An issue was discovered in MediaWiki. When changes made by an IP address are reassigned to a user using...
Romance scammer deepfakes Mark Ruffalo to con elderly artist
Deepfakes have settled into a groove, as most scam techniques do. It seems most deepfakers have decided to make as much cash as possible from unsuspecting victims instead of doing anything particularly earth-shattering with their technology. One curious twist we may not have seen coming is the...
ALSA-2022:6763 Important: bind security update
The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...
The Challenge of Cracking Iran’s Internet Blockade
People around the world are rallying to subvert Iran's internet shutdown, but actually pulling it off is proving difficult and risky...
Hurricane-Related Scams
CISA warns users to remain on alert for malicious cyber activity targeting potential disaster victims and charitable donors following a hurricane. Fraudulent emails—often containing malicious links or attachments—are common after major natural disasters. Exercise caution in handling emails with...
CVE-2022-35137
DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting XSS vulnerabilities...
Hackers Aid Protests Against Iranian Government with Proxies, Leaks and Hacks
Several hacktivist groups are using Telegram and other tools to aid anti-government protests in Iran to bypass regime censorship restrictions amid ongoing unrest in the country following the death of Mahsa Amini in custody. "Key activities are data leaking and selling, including officials' phone...
DGIOT 跨站脚本漏洞
DGIOT is a China DGIOT open source a domestic first lightweight open source industrial IoT continuous integration platform. A security vulnerability exists in DGIOT Lightweight industrial IoT v4.5.4, which stems from the inclusion of multiple cross-site scripting XSS vulnerabilities...
[Security Nation] Taki Uchiyama of Panasonic on Product Security and Incident Response
!\Security Nation\ Taki Uchiyama of Panasonic on Product Security and Incident Responsehttps://blog.rapid7.com/content/images/2022/09/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod chat with Taki Uchiyama about his work on Panasonic’s Product Security Incident Response...
CVE-2022-20915
A vulnerability in the implementation of IPv6 VPN over MPLS 6VPE with Zone-Based Firewall ZBFW of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper error handling of an IP...
Cloudflare Takes a Stab at a Captcha That Doesn’t Suck
The internet infrastructure company has an alternative tool to check whether you’re human—and it doesn’t force you to pick out buses in tiny boxes...
Internet Bug Bounty: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
A vulnerability in Node.js allowed an attacker-controlled DNS server to bypass DNS rebinding protection by resolving hosts in the .local domain. This allowed an attacker to gain access to the Node.js debugger, potentially resulting in remote code execution. The vulnerability affected all versions...
Cisco IOS XE Software和Cisco Catalyst 安全漏洞
Cisco IOS XE Software and Cisco Catalyst are both products of Cisco, Inc.Cisco IOS XE Software is an operating system. A single operating system for enterprise wired and wireless access, aggregation, core and WAN, Cisco IOS XE reduces business and network complexity.Cisco Catalyst is a series of...
CVE-2021-27853
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers...
New Report on IoT Security
The Atlantic Council has published a report on securing the Internet of Things: "Security in the Billions: Toward a Multinational Strategy to Better Secure the IoT Ecosystem." The report examines the regulatory approaches taken by four countries--the US, the UK, Australia, and Singapore--to secur...
