8047 matches found
Moobot Botnet Chews Up Hikvision Surveillance Systems
Although a patch was released in September, any still-vulnerable Hikvision IP Network Video Recorder NVR products are being actively targeted by the Mirai-based botnet known as Moobot. FortiGuard Labs has released a report detailing how the Moobot botnet is leveraging a known remote code executio...
New Hub for Lean IT Security Teams
One of the harsh realities of cybersecurity today is that malicious actors and attackers don’t distinguish between organizations that have seemingly endless resources and those operating with lean IT security teams. For these lean teams, meeting the challenges in the current security landscape...
How to investigate service provider trust chains in the cloud
In a recent Microsoft blog post, we documented technical guidance for organizations to protect themselves from the latest NOBELIUM activity that was found to target technology service providers, which are privileged in their downstream customer tenants, as a method to gain access to their...
SQL Injection Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd.
SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the Flash Flood...
py-matrix-synapse -- several vulnerabilities
Matrix developers report: This release patches one high severity issue affecting Synapse installations 1.47.0 and earlier using the media repository. An attacker could cause these Synapses to download a remote file and store it in a directory outside the media repository. Note that: This only...
On-Demand Webinar: Into the Cryptoverse
In the span of a few years, cryptocurrencies have gone from laughingstock and novelty to a serious financial instrument, and a major sector in high-tech. The price of Bitcoin and Ethereum has gone from single dollars to thousands, and they're increasingly in the mainstream. This is undoubtedly a...
CVE-2021-41266
Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affect...
CVE-2021-41266
Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affect...
CVE-2021-41950
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...
Montala ResourceSpace 路径遍历漏洞
ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...
PT-2021-23227 · Minio · Minio
Name of the Vulnerable Software and Affected Versions: Minio console versions prior to 0.12.3 Description: The Minio console is subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. This issue affects all users on release v0.12.2 and before. The...
PT-2021-23456 · Unknown · Resourcespace
Name of the Vulnerable Software and Affected Versions: ResourceSpace versions 9.6 through 9.6 rev 18277 Description: A directory traversal issue allows remote unauthenticated attackers to delete arbitrary files on the server via the provider and variant parameters in "pages/ajax/tiles.php"...
Clash - A Rule-Based Tunnel In Go
A rule-based tunnel in Go. Features Local HTTP/HTTPS/SOCKS server with authentication support VMess, Shadowsocks, Trojan, Snell protocol support for remote connections Built-in DNS server that aims to minimize DNS pollution attack impact, supports DoH/DoT upstream and fake IP. Rules based off...
The first lp provider can destroy the pool
Handle jonah1005 Vulnerability details Impact First lp provider received liquidity amount same as the nativeDeposit amount and decides the rate. If the first lp sets the pool's rate to an extreme value no one can deposit to the pool afterward. please refer to the proof of concept section A...
OIDC claims not updated from Identity Provider in Pomerium
Impact Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorization decisions. Patches v0.15.6 Workarounds - Clear...
GHSA-J6WP-3859-VXFG OIDC claims not updated from Identity Provider in Pomerium
Impact Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorization decisions. Patches v0.15.6 Workarounds - Clear...
CVE-2021-41366
Credential Security Support Provider Protocol CredSSP Elevation of Privilege Vulnerability...
CVE-2021-41366
Credential Security Support Provider Protocol CredSSP Elevation of Privilege Vulnerability...
Microsoft Windows Multiple Vulnerabilities (KB5007206)
This host is missing a critical security update according to Microsoft KB5007206 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...