DLA-2943-1 ruby-sidekiq - security update

Bulletin has no description...

GHSA-4P92-FV6V-FHFJ Cross-site Scripting in microweber

Microweber prior to 1.2.11 is vulnerable to reflected cross-site scripting...

WIN-911 安全漏洞

Win-911 is a security software from the American company Win-911. It is used for industrial equipment alarm security. A security vulnerability exists in WIN-911 that stems from WIN-911's susceptibility to a privilege misconfiguration. An attacker could use this vulnerability to write files locall...

DSA-5083-1 webkit2gtk - security update

Bulletin has no description...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

Multiple ESET products for macOS vulnerable to improper server certificate verification

Overview Multiple ESET products for macOS are vulnerable to improper server certificate verification CWE-295. KOBAYASHI Yasuyuki reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may...

DLA-2912-1 libphp-adodb - security update

Bulletin has no description...

Mobile Banking Trojan BRATA Gains New, Dangerous Capabilities

The Android malware tracked as BRATA has been updated with new features that grants it the ability to record keystrokes, track device locations, and even perform a factory reset in an apparent bid to cover up fraudulent wire transfers. The latest variants, detected late last year, are said to be...

Software engineer hacked webcams to spy on girls—Here’s how to protect yourself

A 32 year-old software engineer has been sentenced to two years and two months in prison for remotely accessing chat logs, photos, videos, and webcams of his female victims. For nine years, between 2010 to 2019, Robert Davies used malware to infiltrate his targets devices and access their data...

DSA-5043-1 lxml - security update

Bulletin has no description...

ForeScout SecureConnector 安全漏洞

ForeScout SecureConnector is a network security software from US-based ForeScout that authenticates machines trying to join a network. A security vulnerability exists in ForeScout SecureConnector, which can be exploited by an attacker to cause a buffer overflow and overwrite a stack cookie,...

Unspecified Vulnerability in SUPERAntispyware

SUPERAntispyware is a security program from SUPERAntiSpyware. SUPERAntispyware has a security vulnerability that can be exploited by attackers to arbitrarily write data to the device via IOCTL 0x9C402140...

DLA-2864-1 ruby-haml - security update

Bulletin has no description...

IOCs

//////////////// ////////////////////// //...

GHSA-3M3H-V9HV-9J4H Cross-site Scripting in django-wiki

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting XSS in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the...

Improper Neutralization of Formula Elements in a CSV File in html-2-csv

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands vi...

DSA-5014-1 icu - security update

Bulletin has no description...

Improving security for mobile devices: CISA issues guides

The Cybersecurity and Infrastructure Security Agency CISA has released two actionable Capacity Enhancement Guides CEGs to help users and organizations improve mobile device cybersecurity. Consumers One of the guides is intended for consumers. There are an estimated 294 million smart phone users i...

DLA-2802-1 elfutils - security update

Bulletin has no description...

Improper Access Control in jupyterhub-firstuseauthenticator

Impact When JupyterHub is used with FirstUseAuthenticator, the vulnerability allows unauthorized access to any user's account if createusers=True and the username is known or guessed. Patches Upgrade to jupyterhub-firstuseauthenticator to 1.0, or apply patch...