March 25, 2021—KB5000850 (OS Build 18363.1474) Preview

None None...

PT-2021-16559 · Samsung · Samsung Internet

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 13.2.1.70 Description: The issue is related to improper access control, allowing physically proximate attackers to bypass the secret mode's authentication. This could potentially lead to unauthorized access ...

Samsung Internet 安全漏洞

Samsung Internet is a cell phone application from Samsung South Korea. It provides a browser function. A security vulnerability exists in Samsung Internet prior to version 13.2.1.46, which can be exploited by an attacker to launch unexported activities in Samsung Browser via a malicious deeplink...

ProtonVPN CEO Blasts Apple for 'Aiding Tyrants’ in Myanmar

In a blog post filled with a passionate defense of human rights and internet privacy, Andy Yen, the CEO of secure internet provider ProtonVPN, blasted Apple for blocking its latest update and accused the tech juggernaut of helping the global spread of authoritarianism by “giving in to tyrants.” Y...

CVE-2021-1446

A vulnerability in the DNS application layer gateway ALG functionality used by Network Address Translation NAT in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a logic error that occurs when an affected...

CVE-2021-1446

A vulnerability in the DNS application layer gateway ALG functionality used by Network Address Translation NAT in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a logic error that occurs when an affected...

Weak Password Vulnerability in H3C NER324

H3C NER324 is a new-generation enterprise-grade Gigabit high-performance router launched by Xinhua San Technologies Co. It is targeted at the market of Internet cafes, sing-along bars, digital movie theaters and other cultural industries. The H3C NER324 suffers from a weak password vulnerability...

Fedora: Security Advisory for tor (FEDORA-2021-e68317166d)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Contiki 数字错误漏洞

Contiki is an open source cross-platform operating system for IoT Internet of Things devices. A security vulnerability exists in Contiki through 3.0, which stems from a variable that is prone to integer underflow, which can construct an invalid extension header that can lead to memory leakage...

CVE-2021-21402

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public...

Design/Logic Flaw

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public...

CVE-2021-21402 Unauthenticated Arbitrary File Access in Jellyfin

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public...

The human impact of a Royal Mail phishing scam

Last week, we looked at a Royal Mail themed scam which has very quickly become the weapon of choice for phishers. It’s pretty much everywhere at this point. Even one of my relatives with a semi-mystical ability to never experience a scam ever, received a fake SMS at the weekend. The problem with...

Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange

In recent weeks, there has been quite a lot of reporting on the exploitation of the latest disclosed vulnerabilities in Microsoft’s Exchange Server by an attacker referred to as HAFNIUM. One of the major reasons these latest vulnerabilities are so dangerous and appealing to attackers is that they...

Flying Fishstar Technology Development Limited VOLANS has a weak password vulnerability

Founded in 2002, Chengdu Flying Fish Star Technology Co., Ltd. is a high-tech enterprise focusing on product innovation and R&D in digital communication industry and Internet of Things industry. Flying Fish Star Technology Development Co., Ltd VOLANS has a weak password vulnerability that can be...

Changshu Qimao Network Information Technology Co., Ltd. website building system has SQL injection vulnerability

Ltd. is a professional engaged in Changshu website optimization, Changshu website construction, Changshu website production network promotion as one of the integrated Internet enterprises. Changshu Qimao Network Information Technology Co., Ltd. station building system there is a SQL injection...

PT-2021-14479 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.7.1 Description: The issue allows arbitrary file read from a Jellyfin server's file system with well-crafted requests to certain "API Endpoints". This is more prevalent when Windows is used as the host OS. Server...

D-Link DAP-2020 Arbitrary File Read Vulnerability

Founded in 1986 and listed on the Taiwan Stock Exchange in October 1994, D-Link is the first Internet company in Taiwan Province of China to be listed on the Taiwan Stock Exchange. The AUO Group D-Link, established in 1986 and listed on the Taiwan Stock Exchange of China in October 1994, is the...

UNIVERGE Aspire series PBX vulnerable to denial-of-service (DoS)

Overview Remote system maintenance feature of UNIVERGE Aspire series PBX contain an issue in handling commands, which may cause a denial-of-service DoS. NEC Platforms, Ltd. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NEC Platforms, Ltd. coordinate...

Logic Flaw Vulnerability in RG-UAC Riptide Unified Internet Behavior Management and Audit System

Ltd. is a company that utilizes new technologies such as cloud computing, SDN, mobile Internet, big data, and Internet of Things to provide end-to-end solutions for users in various industries. A logic flaw vulnerability exists in the RG-UAC Ruijie Unified Internet Behavior Management and Auditin...