Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing...

Mozilla Firefox command injection vulnerability

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. A security vulnerability exists in Mozilla Firefox, which stems from a failure to display an executable warning when downloading an inetloc file that can run commands on a user's computer. No details of the...

Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing...

Mozilla Thunderbird < 91.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-50 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass...

UBUNTU-CVE-2021-38506

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

Mozilla Thunderbird < 91.3

The version of Thunderbird installed on the remote Windows host is prior to 91.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-50 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions...

Security Vulnerabilities fixed in Thunderbird 91.3 — Mozilla

Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS...

Ransomware Gangs Target Corporate Financial Activities

Ransomware gangs are zeroing in on publicly held companies with the threat of financial exposure in an effort to encourage ransom payments, the FBI is warning. In an alert issued this week PDF, the Bureau said that activity over the course of the past year shows a trend toward targeting companies...

HelloKitty is launching a DDoS attack by exploiting known vulnerabilities

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. The FBI has issued a warning to private businesses about a new feature of the HelloKitty ransomware group aka FiveHands. The Hello Kitty/FiveHands actor UNC2447 employs the double extortion strategy to place undue pressure on...

Mozilla Firefox < 94.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 94.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-48 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass...

Unbreakable Enterprise kernel security update

4.1.12-124.57.1 - target; fix print statement warning John Donnelly Orabug: 33495661 - enic;: fix warning on moduleparam disablevlan0, John Donnelly Orabug: 33495661 - bnx2fc: correct BNX2FCTMTIMEOUT to be 60 sec John Donnelly Orabug: 33495661 - target: Fix linux-4.1.y specific compile warning...

ASB-A-167403112

In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permissions based on insufficient information presented to the user in the consent dialog. This could lead to local escalation of privilege with no additional...

CISA warns of trojanized versions of JavaScript library’s NPM package

By Deeba Ahmed The warning comes days after three rogue packages, okhsa, klow, and klown discovered by DevSecOps firm Sonatype, were removed from the NPM repository. This is a post from HackRead.com Read the original post: CISA warns of trojanized versions of JavaScript librarys NPM package...

Protect yourself from BlackMatter ransomware: Advice issued

Despite promises made by the BlackMatter ransomware gang about which organizations and business types they would avoid, multiple US critical infrastructure entities have been targeted. Now, the Federal Bureau of Investigation FBI, in conjunction with the Cybersecurity and Infrastructure Security...

SUSE-SU-2021:3463-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2021-37600: Fixed an integer overflow which could lead to buffer overflow in getsemelements. bsc1188921 - Prevent outdated pam files bsc1082293, bsc1081947c68. - Do not trim read-only volumes bsc1106214. - libmount: To prevent incorrect...

Schneider Electric ConneXium Network Manager Insufficient UI Warning Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric ConneXium Network Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

How to Disable Warnings for Veeam Enterprise Plug-Ins

Challenge After upgrading to Veeam Backup & Replication 11a build 11.0.1.1261, Enterprise Plug-in backups display the warning: Backup metadata is not up to date. Please upgrade the backup. Copy Cause Starting with Veeam Backup & Replication 11, a new backup file format is used for Enterprise...

SQL injection vulnerability exists in the flash flood monitoring and warning platform of Four Creation Technology Co.

Si Chuang Technology Co., Ltd. is a disaster mitigation and Xingli information service provider in China. There is a SQL injection vulnerability in the flash flood monitoring and early warning platform of Sichong Technology Co., Ltd. which can be exploited by attackers to obtain sensitive...

DDoS booter customers received warning letters by Dutch police

By Waqas Apparently, those who continued using DDoS services after receiving the warning would be prosecuted for a cyber offense. This is a post from HackRead.com Read the original post: DDoS booter customers received warning letters by Dutch police...

Are you a victim of the Conti Ransomware?

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Conti Ransomware targets enterprises who have not patched their systems by exploiting old vulnerabilities. Conti Ransomware steals sensitive information from businesses and demands a ransom in exchange. CISA has issued a...