Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
As security evolves, attackers employ a variety of attack approaches to circumvent the application’s access…Why You Should Always Conduct Application Security …
Instagram earlier this week introduced a new "Security Checkup" feature that aims to keep accounts safe and help users'whose accounts may have been compromised…
IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969). Use-after-free in accessibility features of a document (CVE-2021-29…
Upstream details at : https://access.redhat.com/errata/RHSA-2021:2741
This update upgrades Firefox to version 78.12.0 ESR. * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970) * Mozilla: Memory safet…
A buffer overflow in OpenSCAD might allow remote attacker(s) to execute arbitrary code.
Upstream details at : https://access.redhat.com/errata/RHSA-2021:2683
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "…
XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505) For more details about the security issue(s), including th…
A buffer overflow in ConnMan might allow remote attacker(s) to execute arbitrary code.
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode (CVE-2021-26119). Smarty before 3.1.39 allows code…
The package gitlab before version 14.0.3-1 is vulnerable to multiple issues including cross-site request forgery, access restriction bypass, arbitrary code exe…
Even as MicrosoftÂexpanded patchesÂfor the so-called PrintNightmare vulnerability for Windows 10 version 1607, Windows Server 2012, and Windows Server 2016, it…
An information disclosure vulnerability in InspIRCd may allow remote attackers to obtain sensitive information.
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to …
This week, PrintNightmare - Microsoft's Print Spooler vulnerability (CVE-2021-34527) was upgraded from a 'Low' criticality to a 'Critical' criticality.This is …
Upstream details at : https://access.redhat.com/errata/RHSA-2021:2658
U.S. technology firm Kaseya, which is firefighting the largest everÂsupply-chain ransomware strikeÂon its VSA on-premises product, ruled out the possibility th…
Multiple vulnerabillities have been found in Chromium and Google Chrome, the worst of which could allow remote attackers to execute arbitrary code. [More...]
A vulnerability in XStream, a Java library to serialize objects to and from XML, may allow a remote attacker to execute commands of the host only by manipulati…
* CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, i…
* CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, i…
tpm2: Reset too large size indicators in TPM2B to avoid access beyond buffer
The package jenkins before version 2.300-1 is vulnerable to multiple issues including authentication bypass and access restriction bypass.
