Who Has Control: The SaaS App Admin Paradox

Imagine this: a company-wide lockout to the company CRM, like Salesforce, because the organization's external admin attempts to disable MFA for themselves. They don't think to consult with the security team and don't consider the security implications, only the ease which they need for their team...

PT-2022-32689

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.54 Description The issue concerns a potential security vulnerability in the Linux Kernel. It involves the m can read fifo,echo tx event function, where a shift of the timestamp to full 32 bits may have...

PT-2022-32036

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue is related to the arm64 compatibility mode in the Linux Kernel, where a bad syscall number is not properly handled, potentially leading to security implications. The actual impact a...

PT-2022-31405

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.19 through 5.17.13 Description The issue is related to the drm/vc4 txp component, where a specific condition is not properly handled, potentially leading to security implications. The actual impact and attack plausibili...

PT-2022-31698

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.19 through 5.15.45 Description The issue is related to the drm/vc4 txp component, where a specific condition is not properly handled, potentially leading to security implications. The actual impact and attack plausibili...

PT-2022-31876

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.121 Description The issue is related to the arm64 compatibility mode in the Linux Kernel, where a bad syscall number is not properly handled, potentially leading to security implications. The actual impact...

CVE-2019-25071

A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been...

MantisBT XSS in manage_custom_field_update.php

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

PT-2022-29709

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue concerns ignoring IPv6 endpoints when IPv6 is disabled, potentially leading to security implications. The actual impact and attack plausibility have not yet been proven...

From Pet Systems to Cattle Farm — What Happened to the Data Center?

There's something about craftsmanship. It's personal, its artistry, and it can be incredibly effective in achieving its goals. On the other hand, mass-market production can be effective in other ways, through speed, efficiency, and cost savings. The story of data centers is one of going from...

PT-2021-27279

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.10.58 through 5.10.88 Description A bug in the optee component of the Linux Kernel may have potential security implications, although the actual impact and attack plausibility have not been proven. Recommendations For...

Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

Description The Mobile Options settings does not sanitise and escape the $mboptions'fcmkey' parameter lead to stored XSS Proof of Concept Go to Mobile settings, fill XSS payload into FCM Key field kind of: somekey" Impact XSS can have huge implications for a web application and its users. User...

Fixed in Apache Tomcat 8.5.72

Important: Denial of Service CVE-2021-42340 The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could...

CVE-2021-21705

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filtervar function with FILTERVALIDATEURL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and...

CVE-2021-21705 Incorrect URL validation in FILTER_VALIDATE_URL

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filtervar function with FILTERVALIDATEURL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and...

CVE-2021-21705

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filtervar function with FILTERVALIDATEURL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and...

PT-2021-25674

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.13.4 Description: The issue is related to a potential security vulnerability in the ALSA: usx2y module. It involves a call to free pages exact with a NULL address, which may have security implications. The...

Security implications of misconfigurations

By Jaeson Schultz. When defenders regularly monitor their organization's Domain Name System DNS queries, they can often snuff out potential attacks before they happen. At the very least, it's important to identify and fix configuration mistakes that could lead to nasty security breaches. ... This...

CVE-2021-21705

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filtervar function with FILTERVALIDATEURL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and...

klibc input validation error vulnerability (CNVD-2021-54000)

klibc is an application program. Provides the ability to work from kernel space as early as possible. klibc versions prior to 2.0.9 are vulnerable to an input validation error, which stems from multiple possible integer overflows in the cpio command on 32-bit systems that could lead to buffer...