Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Mitigations for Eleven Severe Chromium Flaws Released
Eleven severe vulnerabilities have been found in Chromium, including multiple Type Confusion bugs in V8, use-after-frees in Cast, Blink Task Scheduling and Web…
Debian LTS: DLA-3522-1: hdf5 security update
Multiple security vulnerabilities were discovered in HDF5, a Hierarchical Data Format and a library for scientific data. Memory leaks, out-of-bound reads and d…
X.Org DoS, Code Execution Vulns Fixed
Several significant out-of-bounds access vulnerabilities have been found in the X.Org X Server (CVE-2021-4008, CVE-2021-4009, and CVE-2021-4011). These flaws t…
How to Improve Your API Security Posture
APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectiv…
Mageia 2023-0082: libraw security update
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/li…
Mageia 2023-0078: nodejs security update
The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.j…
Patch Where it Hurts: Effective Vulnerability Management in 2023
A recently publishedSecurity Navigatorreport data shows that businesses are still taking 215 days to patch a reported vulnerability. Even for critical vulnerab…
Mageia 2022-0465: matio security update
matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). (C…
Mageia 2022-0281: python-django security update
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untruste…
Mageia 2022-0152: librecad security upda
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using …
Fedora 34: grafana 2022-83405f9d
- update to 7.5.15 tagged upstream community sources, see CHANGELOG - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access so…
Red Cross Cyberattack Links Back To A Zoho ManageEngine Vulnerability
A month after the disruptive data breach, Red Cross has shared more details about the…Red Cross Cyberattack Links Back To A Zoho ManageEngine Vulnerability on …
Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
The coordinated cyberattacks targetingUkrainian government websitesand the deployment of a data-wiper malware calledWhisperGateon select government systems are…
Mageia 2022-0002: log4j security upda
Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a …
Vulnerability Scanning Frequency Best Practices
So you've decided to set up a vulnerability scanning programme, great. That's one of the best ways to avoid data breaches. How often you should run your scans,…
Mageia 2021-0520: couchdb security upda
Privilege escalation that allows an attacker to add or remove data in any database or make configuration changes. (CVE-2021-38295) References: - https://bugs.m…
Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug
Unidentified threat actors breached a server running an unpatched, 11-year-old version of Adobe's ColdFusion 9 software in minutes to remotely take over contro…
Researchers Detail Modus Operandi of ShinyHunters Cyber Crime Group
ShinyHunters, a notorious cybercriminal underground group that's been on a data breach spree since last year, has been observed searching companies' GitHub rep…
SciLinux: SLSA-2021-3176-1 Important: microcode_ctl
hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-20…
SciLinux: SLSA-2021-3028-1 Important: microcode_ctl on SL7.x x86_
hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) * hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-20…
Mageia 2021-0338: libebml security upda
A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml (…
Mageia 2021-0321: gupnp security upda
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to …
Mageia 2021-0301: nginx security upda
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap alloca…
Mageia 2021-0240: exiv2 security upda
The updated packages fix security vulnerabilities: Heap-based buffer overflow in Jp2Image::readMetadata(). (CVE-2021-3482) Heap-based buffer overflow in Exiv2:…