291 matches found
CGA-C87F-RGJ5-F9R7
Bulletin has no description...
Active Targeting of WP-Automatic Plugin Flaw Raises Concerns for Site Takeover
...
Other Attempts to Take Over Open Source Projects
After the XZ Utils discovery, people have been examining other open-source projects. Surprising no one, the incident is not unique: The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated...
CVE-2023-5517
creationtimestamp| type| source ---|---|--- 2024-02-13 15:21:58+00:00| seen| https://t.me/ctinow/183865 2024-03-04 08:41:26+00:00| seen| https://t.me/ctinow/199082 2024-11-14 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-08...
High risk in integrating Ocean with Curve TriCrypto pool on Arbitrum
Lines of code Vulnerability details Impact The Curve TriCrypto adapter contract enables swapping, adding liquidity, and removing liquidity for the USDT-WBTC-ETH pool on Arbitrum. However, this pool has been flagged for potential exploit risks. Curve Finance issued a warning: This pool might be at...
GHSA-CR45-98W9-GWQX Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Related issue & discussion: - https://github.com/ArchiveBox/ArchiveBox/issues/239 - https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overviewpublishing - https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archivesecurity-concerns Impact Any users who save untrusted URLs and view...
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Related issue & discussion: - https://github.com/ArchiveBox/ArchiveBox/issues/239 - https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overviewpublishing - https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archivesecurity-concerns Impact Any users who save untrusted URLs and view...
Server prefers weak encryption ciphers during TLS negotiation
TLS cipher suite issues were detected: Server prefers weak encryption ciphers during TLS negotiation...
PT-2023-26904 · Unknown · Siberiancms
Name of the Vulnerable Software and Affected Versions: SiberianCMS affected versions not specified Description: The issue is related to improper handling of insufficient privileges, which can lead to security concerns. There is no information provided about the estimated number of potentially...
GHSA-7G3V-4GGR-XVJF vulnerabilities
Vulnerabilities for packages: croc...
CVE-2023-36308 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator, seaweedfs-operator-fips...
Poorly Purged Medical Devices Present Security Concerns After Sale on Secondary Market
In a post-pandemic landscape, the interconnectedness of cybersecurity is front and center. Few could say that they were not at least aware of, if not directly affected by, the downstream effects of major breaches that cause impacts felt across economies. One should look at disruptions in the glob...
Every company has its own version of ChatGPT now
Welcome to this weeks edition of the Threat Source newsletter. When I first started poking at ChatGPT a few months ago, I quickly learned that it wasnt quite ready to take my job yet and wasnt staying up to date on wrestling. Since ChatGPT went viral, several other companies have released their o...
UBUNTU-CVE-2023-37920
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted ...
I want XAES-256-GCM/11
In 2023, the way to use AES is AES-GCM. Anything else is very unlikely to make sense. We might not like that, we might wish OCB hadn't been patented, but with hardware support in most processors these days GCM is both faster than the alternatives, ubiquitous, and just tolerable to implement. Stil...
Event-Driven Architecture & the Security Implications
This article explores the benefits of event-driven architecture for developers and best practices for mitigating security concerns...
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
We would like to thank The Citizen Lab for their cooperation, support and inputs into this research. Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a...
LayerX’s Browser Security Survey Reveals: 87% of SaaS Adopters Exposed to Browser-borne Attacks in the Past Year
By Deeba Ahmed The first-ever browser security survey of CISOs’ security practices reveals CISOs' struggles, displeasure with current security solutions and cloud concerns. This is a post from HackRead.com Read the original post: LayerX’s Browser Security Survey Reveals: 87% of SaaS Adopters...
Google Authenticator App Gets Cloud Backup Feature for TOTP Codes
Search giant Google on Monday unveiled a major update to its 12-year-old Authenticator app for Android and iOS with an account synchronization option that allows users to back up their time-based one-time passwords TOTPs to the cloud. "This change means users are better protected from lockout and...