Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Arbitrary JavaScript execution in PDF.js. (CVE-2024-4367) IndexedDB files retained in private browsing mode. (CVE-2024-4767) Potential permissions request bypa…
Arbitrary JavaScript execution in PDF.js. (CVE-2024-4367) IndexedDB files retained in private browsing mode. (CVE-2024-4767) Potential permissions request bypa…
Cybersecurity researchers have observed a spike in email phishing campaigns starting early March 2024 that delivers Latrodectus, a nascent malware loader belie…
Google has rolled out fixes to address a set of nine security issues in its Chrome browser, including a new zero-day that has been exploited in the wild.Assign…
Google on Monday shipped emergency fixes to address a new zero-day flaw in the Chrome web browser that has come under active exploitation in the wild.The high-…
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently targeting th…
Financial organizations in the Asia-Pacific (APAC) and Middle East and North Africa (MENA) are being targeted by a new version of an "evolving threat" called J…
Manfred Paul discovered a flaw in the Mozilla Firefox web browser, allowing an attacker to inject an event handler into a privileged object that would allow ar…
GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide t…
Prototype pollution has been fixed in node-xml2js, an XML to JavaScript object converter. For Debian 10 buster, this problem has been fixed in version
A new malware campaign is leveraging a high-severity security flaw in the Popup Builder plugin for WordPress to inject malicious JavaScript code.According to S…
Google on Tuesday released updates to fix four security issues in its Chrome browser, including an actively exploited zero-day flaw.The issue, tracked as CVE-2…
A new set of 48 malicious npm packages have been discovered in the npm repository with capabilities to deploy a reverse shell on compromised systems."These pac…
Cybersecurity researchers have detailed an updated version of an advanced fingerprinting and redirection toolkit calledWoofLockerthat's engineered to conduct t…
An incorrect Authentication Tag length usage was discovered in cjose, a C library implementing the Javascript Object Signing and Encryption (JOSE) standard, wh…
The npm registry for the Node.js JavaScript runtime environment is susceptible to what's called amanifest confusionattack that could potentially allow threat a…
Google on Monday released security updates to patch a high-severity flaw in its Chrome web browser that it said is being actively exploited in the wild.Tracked…
An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Com…
Cross site scripting vulnerability in Javascript escaping. (CVE-2023-28447) Additional bug fixes included. See referenced release notes for details.
Fullscreen notification obscured. (CVE-2023-29533) Double-free in libwebp. (MFSA-TMP-2023-0001) Potential Memory Corruption following Garbage Collector compact…
Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addr…
This update upgrades Firefox to version 102.10.0 ESR. * MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp * Mozilla: Fullscreen notification obscured (CVE-202…
## [3.1.48] - 2023-03-28 ### Security - Fixed Cross site scripting vulnerability in Javascript escaping. This addresses CVE-2023-28447. ### Fixed - Output buff…
An issue has been found in duktape, an embeddable Javascript engine. It was discovered that a special crafted js file could result in a SEGV due to reaching so…
