772 matches found
Code injection
MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures...
CVE-2021-46668
MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures...
CVE-2021-46668
Summary: CVE-2021-46668 affects MariaDB and permits an application crash when executing certain long SELECT DISTINCT statements that interact with storage-engine resource limits for temporary data structures. The core description in the initial document states the issue affects MariaDB through 10...
CVE-2021-46668
Disclaimer: This data contains information about vulnerable...
CVE-2021-46668
Removed by vendor...
CVE-2021-46668
MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures...
Polkit pkexec privilege elevation
Added: 01/27/2022 CVE: CVE-2021-4034 Background Polkit is a Linux package for handling policies that allow unprivileged processes to communicate with privileged processes. It includes a tool called pkexec that allows the user to execute commands as another user according to the polkit policy...
EoL Systems Stonewalling Log4j Fixes for Fed Agencies
Last month, federal agencies were given a Christmas Eve deadline – Dec. 24 – to address the “extremely concerning” Log4j and other vulnerabilities. Nobody said it would be easy. Besides the difficulty of tracking down all instances of the ubiquitous Apache logging library, the job of patching the...
PT-2022-11382 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak versions 12.0.0 through 15.1.1 Description: A flaw was found in Keycloak that allows an attacker with any existing user account to create new default user accounts via the administrative REST API, even when new user registration is...
New Android Malware Targeting Brazil's Itaú Unibanco Bank Customers
Researchers have discovered a new Android banking malware that targets Brazil's Itaú Unibanco with the help of lookalike Google Play Store pages to carry out fraudulent financial transactions on victim devices without their knowledge. "This application has a similar icon and name that could trick...
CoAP Protocol: Definition, Architecture
Professionals involved in IoT network designing or development must have come across CoAP. A dedicatedly set standard by IETF, it works the best when it comes to constrained IoT-enabled solutions. To make you understand CoAP Constrained Application Protocol better, we have prepared this post,...
Server side request forgery (ssrf)
A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...
The Shortfalls of Mean Time Metrics in Cybersecurity
Security teams at mid-sized organizations are constantly faced with the question of "what does success look like?". At ActZero, their continued data-driven approach to cybersecurity invites them to grapple daily with measuring, evaluating, and validating the work they do on behalf of their...
SharpML - Machine Learning Network Share Password Hunting Toolkit
SharpML is a proof of concept file share data mining tool using Machine Learning in Python and C. The tool is discussed in more detail on our blog here, but is summarised below also: SharpML is C and Python based tool that performs a number of operations with a view to mining file shares, queryin...
Agents are not enough: Why cloud security needs agentless deep scanning
In this post, we’re going to dive into the role and limitations of security agents in the cloud, and put forth a different approach for cloud infrastructure security: agentless deep scanning...
Why You Should Consider QEMU Live Patching
Sysadmins know what the risks are of running unpatched services. Given the choice, and unlimited resources, most hardworking administrators will ensure that all systems and services are patched consistently. But things are rarely that simple. Technical resources are limited, and patching can ofte...
Veeam Disaster Recovery Orchestrator limitations with VMware Cloud Offerings
Overview VMware Cloud Verified offerings exist in various forms. This article highlights specific considerations when working with Veeam Recovery Orchestrator, Veeam Backup & Replication, and Veeam ONE for disaster recovery orchestration purposes. Depending on the vendor-specific VMware solution...
Design/Logic Flaw
check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...
SUSE-SU-2021:2924-1 Security update for xen
This update for xen fixes the following issues: Security issues fixed: - CVE-2021-28693: xen/arm: Boot modules are not scrubbed bsc1186428 - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling bsc1186429 - CVE-2021-0089: xen: Speculative Code Store Bypass bsc1186433 -...
