Enalean Tuleap Open Alm SQL注入漏洞

Enalean Tuleap Open Alm is a free and open source tool from Enalean France. for end-to-end traceability of application and system development. A SQL injection vulnerability exists in Tuleap Open Alm, which allows an attacker with read access to the SVN core repository to execute arbitrary SQL...

Writing great alt text: Emotion matters

If you prefer videos to articles, there's an episode of HTTP 203 on this topic. Ok, on with the article… Good alt text means that screen reader users get the same 'meaning' from the page as a fully sighted user. But sometimes that's easier said than done. I recently got stuck trying to figure out...

CVE-2021-37393

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

Threat Source newsletter (July 8, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Just like everyone else in the security world, our week's been dominated by the Kaseya supply chain attack. We went live on pretty much every social media platform we could think of yesterday to update everyone on the... This is on...

The vulnerability of Adobe Reader and Acrobat text readers, related to integer overflow, allows an attacker to execute arbitrary code.

The vulnerability of Adobe Reader and Acrobat text readers is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Siemens SIMATIC RFID Readers Denial of Service Vulnerability

The SIMATIC RF185C, RF186C/CI and RF188C/CI are communication modules for direct connection of image recognition systems to PROFINET IO/Ethernet and OPC UA.The SIMATIC RF300R is a compact RFID reader. A denial of service vulnerability exists in Siemens SIMATIC RFID Readers. An attacker could...

After Updating to Citrix Workspace App for Windows 1912 CU4 USB Card Readers No Longer Work in Epic

Redirecting Ingenico credit card readers does not work as expected in Epic applications after upgrading to Citrix Workspace App for Windows 1912 CU4...

Combatting Insider Threats with Keyboard Security

As cyberattacks snowball and insider threats become an ever-larger part of the problem, it may be time to move beyond purely software-based cyber-defenses. Implementing hardware-based security, like secure keyboards, can be an important part of the mix. Those in IT-leadership roles are well aware...

Threat Source Newsletter (April 22, 2021)

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We went viral this week! Everyone seemed to love to joke about these vulnerabilities we discovered in a WiFi-connected air fryer. An attacker, if they had physical access to the device, could exploit these... This is only the...

PT-2021-8007 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the use of memory after it has been freed during the registration of input/output devices in the Kernel-based Virtual Machine KVM subsystem of the Linux kernel...

Threat Source Newsletter (April 1, 2021)

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We hope you’re enjoying Cisco Live this week and only reading this after you’ve caught up on your sessions for the day. No April Fool’s jokes here thankfully — we are just excited to tell you that applications... This is only the...

Fleeceware Apps Bank $400M in Revenue

About 204 different “fleeceware” applications with a combined billion+ downloads have raked in more than $400 million in revenue so far, via the Apple App Store and Google Play, analysis has revealed. Fleeceware apps generally offer users a free trial to “test” the app, before commencing automati...

ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path

Exploit Title: ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path Exploit Author : SamAlucard Exploit Date: 2021-03-21 Software Version : ActivIdentity 8.2 Vendor Homepage : https://www.hidglobal.com/ Tested on OS: Windows 7 Pro ActivIdentity was Acquired by HID Global in Octuber 2010...

[SECURITY] Fedora 34 Update: pyatspi-2.38.1-1.fc34

at-spi allows assistive technologies to access GTK-based applications. Essentially it exposes the internals of applications for automation, so tools such as screen readers, magnifiers, or even scripting interfaces can query and interact with GUI controls. This package includes a python3 client...

There Are Spying Eyes Everywhere—and Now They Share a Brain

Security cameras. License plate readers. Smartphone trackers. Drones. We’re being watched 24/7. What happens when all those data streams fuse into one?...

CVE-2020-26031

An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers who are authenticated but have insufficient permissions...

[SECURITY] Fedora 33 Update: fprintd-1.90.8-1.fc33

D-Bus service to access fingerprint readers...

Fedora: Security Advisory for fprintd (FEDORA-2020-f997de7d0e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 33 Update: pandoc-2.9.2.1-8.fc33

Pandoc is a Haskell library for converting from one markup format to anothe r, and a command-line tool that uses this library. It can read several dialect s of Markdown and subsets of HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, DokuWiki markup, TWiki markup, TikiWiki markup,...

CVE-2020-16097

On controllers running versions of v8.20 prior to vCR8.20.200221b distributed in v8.20.1093MR2, v8.10 prior to vGR8.10.179 distributed in v8.10.1211MR5, v8.00 prior to vGR8.00.165 Distributed in v8.00.1228MR6, v7.90 prior to vGR7.90.165 distributed in v7.90.1038MRX, v7.80 or earlier, It is possib...