[SECURITY] Fedora 35 Update: ntfs-3g-system-compression-1.0-9.fc35

System compression, also known as "Compact OS", is a Windows feature that allows rarely modified files to be compressed using the XPRESS or LZX compression formats. It is not built directly into NTFS but rather is implemented using reparse points. This feature appeared in Windows 10 and it appear...

The many lives of BlackCat ransomware

The BlackCat ransomware, also known as ALPHV, is a prevalent threat and a prime example of the growing ransomware-as-a-service RaaS gig economy. It’s noteworthy due to its unconventional programming language Rust, multiple target devices and possible entry points, and affiliation with prolific...

The vulnerability affects the implementation of the Control Point Access Point Wireless Provisioning Protocol (CAPWAP) on Cisco IOS XE operating systems, as well as Control Points and Cisco Catalyst 9800 and 9800-CL for Cloud wireless network controllers. This allows a malicious actor to cause service interruptions.

The vulnerability of the CAPWAP protocol implementation in Cisco IOS XE operating systems, as well as in Catalyst access points and Cisco Catalyst 9800 and 9800-CL for Cloud wireless network controllers, is related to an unvalidated return value that causes the zero pointer to be swapped...

The vulnerability in the implementation of the Simple Network Management Protocol (SNMP) on Cisco IOS XE-based Catalyst access points and Cisco Catalyst 9800 and 9800-CL for Cloud wireless network controllers allows a attacker to cause service interruptions.

The vulnerability of the Simple Network Management Protocol SNMP implementation in Cisco IOS XE Catalyst access points and Cisco Catalyst 9800 and 9800-CL for Cloud wireless network controllers is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to...

The software vulnerability of the Cisco Embedded Wireless Controller with Catalyst Access Points allows a intruder to trigger a device reboot or a service failure.

The vulnerability of the Cisco Embedded Wireless Controller with Catalyst Access Points relates to the exhaustion of memory resources. Exploiting this vulnerability can allow a malicious actor to trigger a device reboot or cause a service failure...

Vulnerabilities fixed in Zyxel products

Zyxel has fixed several vulnerabilities in a number of products, including USG, NSG and ATP firewalls. A malicious person could potentially exploit the vulnerabilities to execute arbitrary commands, cause a denial-of-service or obtaining sensitive information. To exploit the vulnerabilities, the...

General Motors suffers credential stuffing attack

American car manufacturer General Motors GM says it experienced a credential stuffing attack last month. During the attack customer information and reward points were stolen. The subject of the attack was an online platform, run by GM, to help owners of Chevrolet, Buick, GMC, and Cadillac vehicle...

recup-points-permis.com Cross Site Scripting vulnerability OBB-2620093

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Center for Threat-Informed Defense, Microsoft, and industry partners streamline MITRE ATT&CK® matrix evaluation for defenders

The MITRE Center for Threat-Informed Defense, Microsoft, and other industry partners collaborated on a project that created a repeatable methodology for developing a top MITRE ATT&CK® techniques list. The method aims to facilitate navigation of the ATT&CK framework, which could help new defenders...

Center for Threat-Informed Defense, Microsoft, and industry partners streamline MITRE ATT&CK® matrix evaluation for defenders

The MITRE Center for Threat-Informed Defense, Microsoft, and other industry partners collaborated on a project that created a repeatable methodology for developing a top MITRE ATT&CK® techniques list. The method aims to facilitate navigation of the ATT&CK framework, which could help new defenders...

CVE-2021-26408

The CVE-2021-26408 issue affects AMD SEV-legacy firmware, where insufficient validation of elliptic curve points during SEV-legacy guest migration could lead to loss of guest integrity or confidentiality. This is rooted in inadequate point validation within SEV-legacy firmware. According to the c...

PT-2022-9758

Name of the Vulnerable Software and Affected Versions SEV-legacy firmware affected versions not specified Description The issue is related to insufficient validation of elliptic curve points in the firmware, which may compromise the integrity or confidentiality of guests during migration...

CVE-2021-26408: Undefined Security Weakness

Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality...

eurotherm-sales.com Cross Site Scripting vulnerability OBB-2613414

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Citrix Gateway Service Points of Presence (PoPs) – Citrix Cloud Japan

In order to ensure business continuity and assure the quality of service for customers using Citrix Gateway service with Citrix Cloud Japan, Citrix provides the following Points of Presence PoPs for Citrix Cloud Japan customers. Customer actions Customers who may have hard-coded the FQDN or IP...

daraint.org Cross Site Scripting vulnerability OBB-2559905

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-0363

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

CVE-2022-0363

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

WordPress plugin myCred 安全漏洞

WordPress is a set of blogging platform developed using the PHP language. myCred 2.4.4, a WordPress plugin, previously had an authorization issue vulnerability, which stems from the plugin's failure to perform any authorization and CSRF checks in the myCred tool's import and export AJAX operation...

CVE-2022-20622

A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service DoS condition. The device may experience a...