Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Mageia 2024-0228: python-scikit-learn Security Advisory Updates
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fi…
Emojis as Weapons: Dissecting DISGOMOJI's Malware Assault on Government Security
DISGOMOJI malware represents an innovative development in cyber espionage tactics, particularly its refined approach to targeting government agencies in India.…
Mageia 2024-0121: x11-server, x11-server-xwayland & tigervnc Security Advisory Updates
Heap buffer overread/data leakage in ProcXIGetSelectedEvents. (CVE-2024-31080) Heap buffer overread/data leakage in ProcXIPassiveGrabDevice. (CVE-2024-31081) U…
Mageia 2024-0095: grub2 security update
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image,…
New "GoFetch" Vulnerability in Apple M-Series Chips Leaks Secret Encryption Keys
A new security shortcoming discovered in Apple M-series chips could be exploited to extract secret keys used during cryptographic operations.Dubbed GoFetch, th…
Debian LTS: DLA-3740-1: gnutls28 security update
Hubert Kario discovered that GnuTLS, a portable library which implements the Transport Layer Security and Datagram Transport Layer Security protocols, was vuln…
Midnight Blizzard and Cloudflare-Atlassian Cybersecurity Incidents: What to Know
The Midnight Blizzard and Cloudflare-Atlassian cybersecurity incidents raised alarms about the vulnerabilities inherent in major SaaS platforms. These incident…
TetrisPhantom: Cyber Espionage via Secure USBs Targets APAC Governments
Government entities in the Asia-Pacific (APAC) region are the target of a long-running cyber espionage campaign dubbedTetrisPhantom."The attacker covertly spie…
Alert: Apache Superset Vulnerabilities Expose Servers to Remote Code Execution Attacks
Patches have been released to address two new securityvulnerabilities in Apache Supersetthat could be exploited by an attacker to gain remote code execution on…
It's a Zero-day? It's Malware? No! It's Username and Password
As cyber threats continue to evolve, adversaries are deploying a range of tools to breach security defenses and compromise sensitive data. Surprisingly, one of…
Debian LTS: DLA-3524-1: linux security update
Daniel Moghimi discovered Gather Data Sampling (GDS), a hardware vulnerability for Intel CPUs which allows unprivileged speculative access to data which was pr…
Mitigations for Eleven Severe Chromium Flaws Released
Eleven severe vulnerabilities have been found in Chromium, including multiple Type Confusion bugs in V8, use-after-frees in Cast, Blink Task Scheduling and Web…
Debian LTS: DLA-3522-1: hdf5 security update
Multiple security vulnerabilities were discovered in HDF5, a Hierarchical Data Format and a library for scientific data. Memory leaks, out-of-bound reads and d…
X.Org DoS, Code Execution Vulns Fixed
Several significant out-of-bounds access vulnerabilities have been found in the X.Org X Server (CVE-2021-4008, CVE-2021-4009, and CVE-2021-4011). These flaws t…
How to Improve Your API Security Posture
APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectiv…
Mageia 2023-0082: libraw security update
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/li…
Mageia 2023-0078: nodejs security update
The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.j…
Patch Where it Hurts: Effective Vulnerability Management in 2023
A recently publishedSecurity Navigatorreport data shows that businesses are still taking 215 days to patch a reported vulnerability. Even for critical vulnerab…
Mageia 2022-0465: matio security update
matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). (C…
Mageia 2022-0281: python-django security update
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untruste…
Mageia 2022-0152: librecad security upda
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using …
Fedora 34: grafana 2022-83405f9d
- update to 7.5.15 tagged upstream community sources, see CHANGELOG - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access so…
Red Cross Cyberattack Links Back To A Zoho ManageEngine Vulnerability
A month after the disruptive data breach, Red Cross has shared more details about the…Red Cross Cyberattack Links Back To A Zoho ManageEngine Vulnerability on …
Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
The coordinated cyberattacks targetingUkrainian government websitesand the deployment of a data-wiper malware calledWhisperGateon select government systems are…