Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Guide to Web Application Penetration Testing
Web applications are an integral part of most business operations today. They are commonly used for storing, processing, or transmitting data in various busine…
Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks
Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal."Ma…
How to Improve Your API Security Posture
APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectiv…
Magento, WooCommerce, WordPress, and Shopify Exploited in Web Skimmer Attack
Cybersecurity researchers have unearthed a new ongoingMagecart-style web skimmer campaign that's designed to steal personally identifiable information (PII) an…
ManageEngine Vulnerability Manager Plus: How To Protect Your Enterprise from Security Vulnerabilities
Vulnerability management is vital to a robust, proactive endpoint security strategy, enabling organizations to identify and address security weaknesses before …
Mageia 2023-0082: libraw security update
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/li…
Mageia 2023-0078: nodejs security update
The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.j…
Mageia 2022-0465: matio security update
matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). (C…
Mageia 2022-0281: python-django security update
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untruste…
Mageia 2022-0152: librecad security upda
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using …
Fedora 34: grafana 2022-83405f9d
- update to 7.5.15 tagged upstream community sources, see CHANGELOG - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access so…
Mageia 2022-0002: log4j security upda
Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a …
Mageia 2021-0520: couchdb security upda
Privilege escalation that allows an attacker to add or remove data in any database or make configuration changes. (CVE-2021-38295) References: - https://bugs.m…
SciLinux: SLSA-2021-3176-1 Important: microcode_ctl
hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-20…
SciLinux: SLSA-2021-3028-1 Important: microcode_ctl on SL7.x x86_
hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) * hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-20…
Mageia 2021-0338: libebml security upda
A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml (…
Mageia 2021-0321: gupnp security upda
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to …
Mageia 2021-0301: nginx security upda
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap alloca…
Mageia 2021-0240: exiv2 security upda
The updated packages fix security vulnerabilities: Heap-based buffer overflow in Jp2Image::readMetadata(). (CVE-2021-3482) Heap-based buffer overflow in Exiv2:…
Linux Porter Discovered M1 Covert Channel Flaw Named ‘M1RACLESâ€
Hector Martin, a hacker who is porting Linux to Apple Silicon Macs through Asahi Linux, has discovered a novel covert channel vulnerability on the M1 chip, cal…
Mageia 2021-0210: pngcheck security upda
This update fixes a divide-by-zero crash bug (and probable vulnerability) in interlaced images with extra compressed data beyond the nominal end of the image d…
Extortion Gang Breaches Cybersecurity Firm Qualys Using Accellion Exploit
Enterprise cloud security firm Qualys has become the latest victim to join a long list of entities to have suffered a data breach after zero-day vulnerabilitie…
Mageia 2020-0363: ansible security upda
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi…
Mageia 2020-0345: mysql-connector-python security upda
Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human i…