Security Bulletin: Vulnerability in Node.js affects IBM Event Streams

Summary There is a vulnerability in the Node.js ua-parser-js open source module. The library is used by the IBM Event Streams. Vulnerability Details Third Party Entry: 211964 DESCRIPTION: Node.js ua-parser-js module could allow a remote attacker to execute arbitrary code on the system, caused by...

2021 in Review, Part 4: 5 Cybersecurity Topics to Watch in 2022

One of the core principles of cybersecurity is not letting things “slip through the cracks”. An effective security posture depends on visibility. The more visibility you have into the environments where your data is, the more successful you will be in applying your organization’s security protoco...

多款Qualcomm产品信息泄露漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc. and are often manufactured on the surface of semiconductor wafers. The Qualcomm chip suffers from an information disclosure vulnerability that...

CVE-2021-37132

PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-party apps can obtain the complete list of Harmony apps without permission...

CVE-2021-37132

PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-party apps can obtain the complete list of Harmony apps without permission...

CVE-2021-37132

The CVE-2021-37132 issue affects Huawei HarmonyOS: PackageManagerService contains a Permissions, Privileges, and Access Controls vulnerability that allows third‑party apps to obtain the complete list of Harmony apps without permission. This is triggered by improper access controls in the service,...

SQLite report about CVE-2022-21227

This CVE describes a bug in a third-party packages that provides a binding for SQLite to Node.js. The bug reported is in the third-party Node.js binding, not in SQLite itself. Do not be confused by the use of the word "SQLite" in the ambiguously-worded CVE description...

Rook: New Ransomware in the market scavenges code from Babuk

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Security researchers found new ransomware dubbed as Rook that reuses the code from Babuk which was released earlier. It was initially seen on VirusTotal on November 26th and pwned its first victim, a Kazkh financial...

Design/Logic Flaw

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity de.niklasmerz.cordova.biometric.BiometricActivity can cause the app to crash. This vulnerability occurred...

[SECURITY] Fedora 34 Update: tang-11-1.fc34

Tang is a small daemon for binding data to the presence of a third party...

[SECURITY] Fedora 35 Update: tang-11-1.fc35

Tang is a small daemon for binding data to the presence of a third party...

Fresenius Kabi Agilia Connect Infusion System (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Fresenius Kabi Equipment: Agilia Connect Infusion System Vulnerabilities: Uncontrolled Resource Consumption, Use of a Broken or Risky Cryptographic Algorithm, Insufficiently Protected Credentials,...

SHOULD CHECK RETURN DATA FROM CHAINLINK AGGREGATORS

Handle defsec Vulnerability details Impact The latestRoundData function in the contract PriceFeed.sol fetches the asset price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID. Stale prices could put funds at risk. According to Chainlink's...

What the Log4Shell Bug Means for SMBs: Experts Weigh In

News of the Log4Shell vulnerability is everywhere, with security experts variously calling the Apache log4j logging library bug a recipe for an “internet meltdown,” as well as the “worst cybersecurity bug of the year.” Names like “Apple,” “Twitter” and “Cloudflare” are being bandied about as bein...

Denial Of Service (DoS)

firefox:edge is vulnerable to denial of service. WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568 Dart - Publishing to third-party package repositories may expose pub.dev credentials

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

The CVE describes a vulnerability in the Dart toolchain where, during dart pub publish to a third‑party package server, the request is authenticated with an oauth2 access_token that is valid for pub.dev. An attacker obtaining these credentials can impersonate the user on pub.dev. The issue is mit...

CVE-2021-43540

WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox 95...

CVE-2021-43540

WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox 95...