Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically…
Security researchers have discovered some new Linux-based ransomware that's being used to attack VMware ESXi servers, a bare-metal hypervisor for creating and …
out-of-bounds read in gchar_cursor() in misc1.c (CVE-2022-1851) use-after-free in find_pattern_in_path() in search.c (CVE-2022-1898) out-of-bounds write in vim…
Less privileged Webmin users (excluding those created by Virtualmin and Cloudmin) can modify arbitrary files with root privileges, and so run commands as root …
**MariaDB 10.5.16** Release notes: https://mariadb.com/kb/en/mariadb-10516-release-notes/
**MariaDB 10.5.16** Release notes: https://mariadb.com/kb/en/mariadb-10516-release-notes/
While allowing public access to the sensitive behind-the-scenes operation of a program sounds risky, open-source software actually has the potential to be even…
Joshua Mason discovered that a logic error in the validation of the secret key used in the "local" authorisation mode of the CUPS printing system may result in…
As we rapidly transition to an increasingly digital society, data protection is a greater concern than ever before. Encryption is one of the most effective and…
Yet another malicious Python package has been spotted in the PyPI registry performing supply chain attacks to drop Cobalt Strike beacons and backdoors on Windo…
Yet another malicious Python package has been spotted in the PyPI registry performing supply chain attacks to drop Cobalt Strike beacons and backdoors on Windo…
A large number of servers running the Kubernetes API have been left exposed to the internet, which is not great: they're potentially vulnerable to abuse.
A large number of servers running the Kubernetes API have been left exposed to the internet, which is not great: they're potentially vulnerable to abuse.
The financial services company's prototype system based on CNCF's software supply chain security guidelines joins OpenSSF's $150 million open source standards …
zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032) For more details about the security issue(s), including the imp…
"It's important for the industry to understand that open source development burnout is real and can have a significant impact upon those who depend on the proj…
Felix Wilhelm discovered that libxml2, the GNOME XML library, did not correctly check for integer overflows or used wrong types for buffer sizes. This could re…
Waitress is a Python WSGI server, an application server for Python web apps. Security updates to fix request smuggling bugs, when combined with another http pr…
Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the "security-restricted operation" sandbox. For additional informat…
Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the "security-restricted operation" sandbox. For additional informat…
** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a craft…
Researchers have uncovered a highly-evasive Chinese surveillance tool using the Berkeley Packet Filter (BPF). The malware, dubbed BPFDoor, is present on ''thou…
Computer security only happens when software is kept up to date. That should be a basic tenet for business users and IT departments. Apparently, it isn't. At l…
**MariaDB 10.5.15** Release notes: https://mariadb.com/kb/en/mariadb-10515-release-notes/
