Lumos System Can Find Hidden Cameras and IoT Devices in Your Airbnb or Hotel Room

A group of academics has devised a system that can be used on a phone or a laptop to identify and locate Wi-Fi-connected hidden IoT devices in unfamiliar physical spaces. With hidden cameras being increasingly used to snoop on individuals in hotel rooms and Airbnbs, the goal is to be able to...

Update now! Multiple vulnerabilities patched in Google Chrome

Google has announced an update for the Chrome browser that includes 32 security fixes. The severity rating for one of the patched vulnerabilities is Critical. The stable channel was promoted to 102.0.5005.61/62/63 for Windows, and 102.0.5005.61 for Mac and Linux. Critical Google rates...

Google Releases Security Updates for Chrome

Google has released Chrome version 102.0.5005.61 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review the Chrome Release Note and apply the necessary update. Thi...

NuGet Package Manager Tampering Vulnerability

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder by default obj, aka 'NuGet Package Manager Tampering Vulnerability'...

GHSA-3HCM-6FJC-47QQ NuGet Package Manager Tampering Vulnerability

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder by default obj, aka 'NuGet Package Manager Tampering Vulnerability'...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS when creating HTTPS web requests while building X509 certificate chains. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS when creating HTTPS web requests while building X509 certificate chains. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users...

Missing SSH host key validation in Mac Plugin

Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Mac Plugin 1.2.0 validates SSH host keys when...

GHSA-RV9G-67F7-GRQ7 Missing SSH host key validation in Mac Plugin

Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Mac Plugin 1.2.0 validates SSH host keys when...

GHSA-2M74-X26C-G7XC Missing permission checks in Mac Plugin

A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials...

Missing permission checks in Mac Plugin

A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials...

CSRF vulnerability in Mac Plugin

A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials...

GHSA-QCFQ-35V7-4FW7 CSRF vulnerability in Mac Plugin

A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials...

GHSA-MCPW-CP35-P3H8 OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instance...

OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instance...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 102 to the stable channel for Windows 102.0.5005.61/62/63, 102.0.5005.61 for Mac and Linux.Chrome 102 is also promoted to our new extended stable channel for Windows and Mac. This will roll out over the coming days/weeks. Chrome...

Uncaught Exception

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic ...

Mozilla Firefox < 100.0.2

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 100.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-19 advisory. - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,...

Mozilla Thunderbird < 91.9.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.9.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-19 advisory. - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution...

macOS 12.x < 12.4 Multiple Vulnerabilities (HT213257)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.4. It is, therefore, affected by multiple vulnerabilities: - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 - A crafted URI se...