Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Mageia 2022-0002: log4j security upda
Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a …
Vulnerability Scanning Frequency Best Practices
So you've decided to set up a vulnerability scanning programme, great. That's one of the best ways to avoid data breaches. How often you should run your scans,…
Mageia 2021-0520: couchdb security upda
Privilege escalation that allows an attacker to add or remove data in any database or make configuration changes. (CVE-2021-38295) References: - https://bugs.m…
Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug
Unidentified threat actors breached a server running an unpatched, 11-year-old version of Adobe's ColdFusion 9 software in minutes to remotely take over contro…
Researchers Detail Modus Operandi of ShinyHunters Cyber Crime Group
ShinyHunters, a notorious cybercriminal underground group that's been on a data breach spree since last year, has been observed searching companies' GitHub rep…
SciLinux: SLSA-2021-3176-1 Important: microcode_ctl
hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-20…
SciLinux: SLSA-2021-3028-1 Important: microcode_ctl on SL7.x x86_
hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) * hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-20…
Mageia 2021-0338: libebml security upda
A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml (…
Mageia 2021-0321: gupnp security upda
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to …
Mageia 2021-0301: nginx security upda
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap alloca…
Mageia 2021-0240: exiv2 security upda
The updated packages fix security vulnerabilities: Heap-based buffer overflow in Jp2Image::readMetadata(). (CVE-2021-3482) Heap-based buffer overflow in Exiv2:…
Linux Porter Discovered M1 Covert Channel Flaw Named ‘M1RACLESâ€
Hector Martin, a hacker who is porting Linux to Apple Silicon Macs through Asahi Linux, has discovered a novel covert channel vulnerability on the M1 chip, cal…
Mageia 2021-0210: pngcheck security upda
This update fixes a divide-by-zero crash bug (and probable vulnerability) in interlaced images with extra compressed data beyond the nominal end of the image d…
Mageia 2020-0363: ansible security upda
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi…
Mageia 2020-0345: mysql-connector-python security upda
Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human i…
Debian LTS: DLA-2344-1: mongodb security upda
A denial of service vulnerability was discovered in mongodb, an object/document-oriented database, whereby a user authorized to perform database queries may is…
Debian LTS: DLA-2327-1: lucene-solr security upda
A security vulnerability was discovered in lucene-solr, an enterprise search server. The DataImportHandler, an optional but popular module to pull in data
SciLinux: SLSA-2020-2433-1 Moderate: microcode_ctl on SL6.x i386/x86_
hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Vector Register Data Sampling (CVE-20…
Mageia 2020-0211: netkit-telnet security upda
Updated netkit-telnetd packages fix security vulnerability: A vulnerability was found where incorrect bounds checks in the telnet server's (telnetd) handling o…
Slack Patch Critical Vulnerability Allowing Automated Account Takeovers
A critical security vulnerability existed in Slack that could have lead to a massive data breach affecting its customers. SlackSlack Patch Critical Vulnerabili…
9 Years of AMD Processors Vulnerable to 2 New Side-Channel Attacks
AMD processors from as early as 2011 to 2019 carry previously undisclosed vulnerabilities that open them to two new different side-channel attacks, according t…
New ZombieLoad v2 Attack Affects Intel's Latest Cascade Lake CPUs
Zombieload is back.This time a new variant (v2) of the data-leaking side-channel vulnerability also affects the most recent Intel CPUs, including the latest Ca…
Debian LTS: DLA-1954-1: lucene-solr security update
A security vulnerability was discovered in lucene-solr, an enterprise search server. The DataImportHandler, an optional but popular module to pull in data
Warning: Researcher Drops phpMyAdmin Zero-Day Affecting All Versions
A cybersecurity researcher recently published details and proof-of-concept for an unpatched zero-day vulnerability in phpMyAdmin'one of the most popular applic…