Vulnerabilities

Vulnerabilities

Issued by: Security Week

The impacted devices include the SMA 200, 210, 400, 410, and 500 edge network access control systems that have the Web Application Firewall (WAF) enabled. The most severe of these vulnerabilities is CVE-2021-20038 (CVSS score of 9.8), an unauthenticated stack-based buffer overflow that could lead to remote code execution (RCE) as the ‘nobody’ user. “The…

Vulnerabilities

Issued by: Security Week

Of the 26 security holes fixed in the Windows and macOS versions of Acrobat and Reader, 16 have been assigned a “critical” severity rating (high severity based on their CVSS score), and a majority are memory-related issues that can be exploited for arbitrary code execution. Four of these critical vulnerabilities — CVE-2021-44704 through CVE-2021-44707 —…

Application Security, Cloud Security, Vulnerabilities

Issued by: Security Week

Tracked as CVE-2021-22045 (CVSS score of 7.7), the security vulnerability exists in the CD-ROM device emulation function of Workstation, Fusion and ESXi. In an advisory, VMWare said the security defect could be exploited by attackers with access to a virtual machine that has CD-ROM device emulation enabled. An attacker capable of combining the security error…

Vulnerabilities

Issued by: Security Week

A file containing the personal identity card numbers, employment and salary data of some 637,000 people became public this week and was widely shared through messaging apps. Prime Minister Edi Rama said the leak is being investigated. “According to a preliminary analysis, it looks more like an internal infiltration rather than an outside … cyber-attack,”…

Vulnerabilities

Issued by: Help Net Security

On Thursday, December 9, 2021, my young, Minecraft-addicted kids were still completely oblivious of the Log4j vulnerabilities in their favorite game. Then again, so was every cybersecurity professional in the world. That all changed when the Apache Log4j project announced CVE-2021-44228 (aka Log4Shell) – a zero-day vulnerability in Log4j’s standardized method of handling log files…

Vulnerabilities

Issued by: Security Week

Corellium, a Florida-based company with its roots in the iPhone jailbreaking community, said the $25 million Series A also included investments from Cisco investments and other strategic investors. Corellium LogoThe money comes exactly a year after a federal judge dismissed Apple’s copyright lawsuit against Corellium and the two sides reached a settlement on another matter…

Vulnerabilities

Issued by: Security Week

As part of its bug bounty program, the company will pay monetary rewards to security researchers who discover flaws that allow attackers to bypass existing scraping limitations and gain access to data at scale. Scrapers – including malicious apps, scripts, and websites – constantly adapt to evade detection, and Facebook says it is seeking ways…