Security Leftovers
-
CISA SBOM standards efforts stymied by confusion, inertia [Ed: CISA lobbying for Microsoft interests]
-
Exploitation of Barracuda ESG appliances linked to Chinese spies [Ed: Political slant to distract from the bug and shift focus to one among a million parties that can take advantage]
-
XSS Vulnerabilities Found in Microsoft Azure Cloud Services
Two cloud security vulnerabilities — in Azure Bastion and Azure Container Registry — were found in Microsoft Azure's services, which allowed an attacker to achieve cross-site scripting (XSS)...
-
Louis-Philippe Véronneau: Solo V2: nice but flawed
I recently received the two Solo V2 hardware tokens I ordered as part of their crowdfunding campaign, back in March 2022. It did take them longer than advertised to ship me the tokens, but that's hardly unexpected from such small-scale, crowdfunded undertaking.
-
Important Fix for c-ares DoS Bug Released
Several important security vulnerabilities have been found in the c-ares fork of the ares library, including a 0-byte UDP payload denial of service (DoS) bug (CVE-2023-32067). With low attack complexity, no privileges or user interaction required to exploit, and a high availability impact, this flaw has received a National Vulnerability Database (NVD) base score of 7.5 out of 10 (''High'' severity).
-
OpenJDK DoS, Info Disclosure Vulns Fixed
Several important denial of service (DoS) and information disclosure vulnerabilities have been discovered in the OpenJDK Java runtime. These bugs require no privileges or user interaction to exploit, and have been classified by the National Vulnerability Database as having a high confidentiality, integrity and availability impact on affected systems.
-
Threat activity and vulnerabilities in Indonesia, Malaysia, Philippines, and Thailand
Guest Post: Understanding the attack surface of ASEAN economies to better support them.
-
Another RAT Delivered Through VBS, (Fri, Jun 16th) [Ed: Windows TCO]
The invoice icon pointed to a URL. Usually, such URLs display a fake login page asking for credentials. Not this time.
-
Ransomware Group Starts Naming Victims of MOVEit Zero-Day Attacks [Ed: Windows TCO]
The Cl0p ransomware gang has listed more than two dozen victims of the MOVEit zero-day attack on its leak website.