6585 matches found
Tenable Nessus 10.x < 10.1.0 / 8.x < 8.15.3 Third-Party Vulnerability (TNS-2022-04)
According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.1.0, or 8.x prior to 8.15.3. It is, therefore, affected by a vulnerability in a third-party library: - The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and...
Me on App Store Monopolies and Security
There are two bills working their way through Congress that would force companies like Apple to allow competitive app stores. Apple hates this, since it would break its monopoly, and its making a variety of security arguments to bolster its argument. I have written a rebuttal: I would like to...
8x8: Open Redirect on https://██.8x8.com/login?nextPage=%2F
@ig420vrush reported to us an Open Redirect after login in a 3rd party referral platform. We swiftly relayed this to the vendor and their engineering team fixed the affected code, which resolved the issue...
ASB-A-207479207
ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrarily modify and set system properties。...
[R1] Nessus 10.1.0 Fixes One Third-Party Vulnerability
R1 Nessus 10.1.0 Fixes One Third-Party Vulnerability Jason Schavel Mon, 01/31/2022 - 10:14 Nessus leverages third-party software to help provide underlying functionality. One of the third-party components Underscore.js was found to contain a vulnerability, and an updated version has been made...
Exposure of Sensitive Information in simple-get
In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party...
About the security content of Safari 15.3
About the security content of Safari 15.3 This document describes the security content of Safari 15.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
CollectorStealerBuilder Panel 2.0.0 Insecure Credential Storage
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/54530f88c8e4f4371c9418f00c256b1d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: CollectorStealerBuilder v2.0.0 Panel Vulnerability: Insecure Credential Storage Description: The pan...
CollectorStealerBuilder Panel 2.0.0 Insecure Credential Storage Vulnerability
The panel for Collector Stealer malware version 2.0.0 stores the login credentials in plaintext in its MySQL database. Third-party attackers who gain access to the system can read the database username passwords without having to crack them offline. Discovery / credits: Malvuln - malvuln.com c 20...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
Open-Source Security: Getting to the Root of the Problem
The past few weeks have shown us the importance and wide reach of open-source security. In December 2021, public disclosure of the Log4Shell vulnerability in Log4j, an open-source logging library, caused a cascade of dependency analysis by developers in organizations around the world. The inciden...
Drupal core - Moderately critical - Cross site scripting - SA-CORE-2022-002
jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. Late in 2021, jQuery UI announced that they would be continuing development, and released a jQuery UI 1.13.0 version. In addition to the issue covered by SA-CORE-2022-001, further security...
Oracle Critical Patch Update Advisory - January 2022
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third-party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...
Information Disclosure
node-fetch is vulnerable to information disclosure. The vulnerability exists due to the cookie header being leaked to third party site which allows an attacker to gain access to sensitive information...
A Teen Took Control of Teslas by Hacking a Third-Party App
Plus: Open source sabotage, Ukrainian website hacks, and more of the week's top security news...
CVE-2021-44530
An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier Log4J CVE-2021-44228 allows a malicious actor to control the application...