1684 matches found
The vulnerability of the Windows GDI component in Windows operating systems allows attackers to disclose sensitive information that is protected by security measures.
The vulnerability of Windows GDI components in Windows operating systems is related to security flaws in the system’s mechanisms. Exploiting this vulnerability allows a malicious actor to disclose protected information remotely...
Microsoft Patch Tuesday, March 2020 Edition
Microsoft Corp. today released updates to plug more than 100 security holes in its various Windows operating systems and associated software. If you abuse Windows, please take a moment to read this post, backup your systems, and patch your PCs. All told, this patch batch addresses at least 115...
Firefox Bug Opens iPhone AirPods to Third-Party Snooping
Five high-severity bugs were fixed in the Firefox web browser with the release of version 74 by the Mozilla Foundation on Tuesday. In addition, Mozilla reported a quirky moderate-severity flaw that allows hackers to target iPhone users and collect data tied to connected AirPods, if in use. In...
This Week in Security News: Trend Micro Detects a 10 Percent Rise in Ransomware in 2019 and New Wi-Fi Encryption Vulnerability Affects Over a Billion Devices
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read about how Trend Micro detected a 10 percent rise in ransomware attacks in 2019. Also, learn about a new Wi-Fi encryption vulnerability...
IoT Insecurity: When Your Vacuum Turns on You
SAN FRANCISCO – Hackable Internet of Things IoT devices are on full display this week at the RSA Conference 2020. They include everything from baby monitors to Wi-Fi chips. One such device is a connected vacuum cleaner, the Trifo Ironpie M6. According to researchers with Checkmarx, the vacuum has...
Unpatched Security Flaws Open Connected Vacuum to Takeover
SAN FRANCISCO – Researchers have discovered several high-severity vulnerabilities in a connected vacuum cleaner. The security holes could give remote attackers the capability to launch an array of attacks — from a denial of service DoS attack that renders the vacuum unusable, to viewing private...
Cross site scripting
Multiple cross-site request forgery CSRF and cross-site scripting XSS vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator account via an addnew action to admin/administratorsadd.php; or 2 conduct...
Researchers: Hackers Can Seize Control of Ballots Cast Using the Voatz Voting App
Security researchers have found key flaws in a mobile voting app that some states plan to use in the 2020 election that can allow hackers to launch both client- and server-side attacks that can easily manipulate or even delete someone’s vote, as well as prevent a reliable audit from taking place...
Mozilla Firefox 73 Browser Update Fixes High-Severity RCE Bugs
Mozilla has launched the latest version of its Firefox browser, which knocks out high-severity security flaws that leave systems open to attack by a remote adversary. The patched version of Mozilla’s browser, launched on Tuesday, is Firefox 73 and Firefox ESR 68.5. The Firefox ESR browser is its...
Hacker Leaks More Than 500K Telnet Credentials for IoT Devices
A hacker has published a list of credentials for more than 515,000 servers, home routers and other Internet of Things IoT devices online on a popular hacking forum in what’s being touted as the biggest leak of Telnet passwords to date, according to a published report. The leak—revealed in a repor...
CVE-2020-2584 vulnerabilities
Vulnerabilities for packages: mysql...
Fedora 30 : git (2019-1cec196e20)
Per the upstream release announcement¹, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE...
Hackers Could Use Smart Displays to Spy on Meetings
By exploiting flaws in popular video conferencing hardware from DTEN, attackers can monitor audio, capture slides—and take full control of devices...
Serious Security Flaws Found in Children's Connected Toys
Various connected toys for children – hot off the shelves from this holiday shopping season – have been found with deep-rooted security issues, including missing authentication for device pairing and a lack of encryption for connected online accounts. The research, formed by a partnership between...
USN-4202-2 thunderbird regression
USN-4202-1 fixed vulnerabilities in Thunderbird. After upgrading, Thunderbird created a new profile for some users. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that a specially crafted S/MIME message with an inner encryption laye...
USN-4220-1: Git vulnerabilities
Joern Schneeweisz and Nicolas Joly discovered that Git contained various security flaws. An attacker could possibly use these issues to overwrite arbitrary paths, execute arbitrary code, and overwrite files in the .git directory...
TPM-Fail Attacks Against Cryptographic Coprocessors
Really interesting research: TPM-FAIL: TPM meets Timing and Lattice Attacks, by Daniel Moghimi, Berk Sunar, Thomas Eisenbarth, and Nadia Heninger. Abstract: Trusted Platform Module TPM serves as a hardware-based root of trust that protects cryptographic keys from privileged system and physical...
Mail.ru: Account TakeOver through password recovery at am.ru
Insufficient protection allowed account takeover at am.ru via account recovery code bruteforcing Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...