Security Leftovers
-
Critical LibreOffice Code Execution Vuln Fixed
An Improper Validation of Array Index vulnerability (CVE-2023-0950) was discovered in the spreadsheet component of The Document Foundation LibreOffice 7.4 versions prior to 7.4.6 and 7.5 versions prior to 7.5.1. With a low attack complexity, no privileges or user interaction required to exploit, and a high confidentiality, integrity and availability impact, this bug has received a National Vulnerability Database (NVD) severity rating of ''Critical''.
-
2023-06-02 [Older] Car thieves are using increasingly sophisticated methods, and most new vehicles are vulnerable
-
ICYMI: Five Things Scammers Hope You "Google"
Your email address may actually be hurting your chances for landing that new job, according to an article on Lifehacker. Believe it or not (or like it or not), gmail.com email addresses are generally viewed as "neutral." Addresses from aol.com or yahoo.com may elicit concerns about your age. And email addresses like "ladysman@someemail.com" or "satansoffspring@anotheremail.com" or "darthvaderfan@sith.net" may be torpedoing your job chances before you ever get out of port, so to speak.
The U.S., Europe and Ukraine are reportedly targets in this malware threat involving Cisco routers, according to an article on TechRepublic. State--sponsored Russian threat actor APT28 targets certain Cisco routers with an old vulnerability. I'll wait patiently to see a show of hands of everyone who has ever/never applied patches to their router. [chirp-chirp] [chirp-chirp] [chirp-chirp] sing the crickets. Yeah ... me neither. Routers (and other hardware) can be "borked" or "bricked" too easily while applying patches, and cost too much to replace (if they do end up borked/bricked). Thus, the vast majority of users never do apply patches to hardware, despite the presence of a valid and verified threat vector. Fortunately (unfortunately?) these particular Cisco routers (they never say in the article exactly which routers are affected) appear to be "commercial" routers. But then again, you can never know for sure which consumer-level Cisco routers use a command or SNMP protocol (the attack vector) that has been (or may have been) "inherited" from the commercial side of their business.