#security-vulnerabilities

[ follow ]
Information security
Theregister
4 weeks ago
Information security

JetBrains fixes 26 'security problems,' offering no details

JetBrains urged users to upgrade due to 26 security issues in TeamCity.
JetBrains declined to disclose details for security fixes. [ more ]
CyberScoop
1 month ago
Information security

ONCD releases report on the adoption of memory-safe languages

Memory safe programming languages can reduce common vulnerabilities.
National Cyber Director calls for software and hardware creators to prioritize addressing memory safety issues. [ more ]
Theregister
3 months ago
Information security

January Patch Tuesday: New year, new Windows' bugs

Microsoft released 49 Windows security updates, including fixes for two critical-rated bugs.
There are four high-severity Chrome flaws in Microsoft Edge. [ more ]
TechRepublic
10 months ago
Information security

8 best practices for securing your Mac from hackers in 2023

1. Always keep your Mac updated with the latest security patches and software updates.
2. Use a strong, unique password for your Mac and use two-factor authentication.
3. Use a reputable antivirus and anti-malware software to protect your Mac from malicious threats.
SecurityWeek
1 year ago
Information security

Apple Patches WebKit Code Execution in iPhones, MacBooks

Apple's product security response team on Monday rolled out patches to cover numerous serious security vulnerabilities affecting users of its flagship iOS and macOS platforms.The most serious of the documented vulnerabilities affect WebKit and can expose both iOS and macOS devices to code execution attacks via booby-trapped web content, Apple warned in multiple advisories.
Theregister
1 year ago
Information security

Microsoft vulnerabilities down for 2021

Despite a record number of publicly disclosed security flaws in 2021, Microsoft managed to improve its stats, according to research from BeyondTrust.
moreInformation security
Privacy professionals
ABC7 San Francisco
1 month ago
Privacy professionals

Researchers pose as hackers, exposing security flaw that could open your hotel-room door

Hotel security flaw exposed by researchers posing as hackers
Lock manufacturer updating security to fix vulnerabilities [ more ]
Theregister
1 month ago
Privacy professionals

Truck-to-truck worm could infect entire US fleet

Over 14 million ELDs in US trucks are vulnerable to cybersecurity threats.
ELDs can be accessed over Bluetooth or Wi-Fi to control trucks, manipulate data, and spread malware. [ more ]
Ars Technica
1 month ago
Privacy professionals

$30 doorbell cameras have multiple serious security flaws, says Consumer Reports

Budget video doorbell cameras from brands like Eken and Tuck have unsettling security vulnerabilities.
Consumer Reports found that these cameras transfer sensitive data without encryption and can easily be taken over through the mobile app. [ more ]
Futurism
2 months ago
Privacy professionals

Warning: "AI Girlfriends" Are Hoarding Your Personal Data

AI companion bots have concerning privacy pitfalls and murky data use policies.
AI soulmates and AI girlfriends/boyfriends are data-hoarding troves of privacy tripwires. [ more ]
ComputerWeekly.com
1 year ago
Privacy professionals

Salt Labs identifies OAuth security flaw within Booking.com | Computer Weekly

Critical security flaws in Booking.com'simplementation of Open Authorization (OAuth) could have enabled attackers to launch large-scale account takeovers, putting millions of people's sensitive personal data at risk, finds threat research by Salt Labs.An industry-standard social login protocol, OAuth allows users to log in to sites via their social media accounts, but by manipulating certain steps in Booking.com's
ComputerWeekly.com
1 year ago
Privacy professionals

Lego fixes dangerous API vuln in BrickLink service | TechTarget

The Lego Group has moved swiftly to fix a pair of application programming interface (API) security vulnerabilities that existed in its BrickLink digital resale platform, after they were identified by Salt Labs, the research arm of API specialist Salt Security.With over a million members, BrickLink is the world's largest forum for buying and selling second-hand Lego sets.
morePrivacy professionals
TechCrunch
1 month ago
Web development

GitHub's latest AI tool that can automatically fix code vulnerabilities | TechCrunch

GitHub launches code scanning autofix feature for security vulnerabilities.
GitHub's new feature combines Copilot and CodeQL for real-time vulnerability remediation. [ more ]
Theregister
1 month ago
Artificial intelligence

Researchers jimmy OpenAI's and Google's closed models

Researchers discovered an attack on AI services to reveal hidden parts of transformer models through API queries.
The attack can expose the embedding projection layer of black box models, costing from a few dollars to several thousand depending on model size. [ more ]
InfoQ
3 months ago
Artificial intelligence

Custom GPTs from OpenAI May Leak Sensitive Information

OpenAI's GPT models are susceptible to prompt injection attacks, which can expose sensitive information.
Customizable GPT models need robust security frameworks to address potential vulnerabilities. [ more ]
DevOps
New Relic
2 months ago
DevOps

How New Relic's Kubernetes Agents team decreased release time by 99% with GitHub workflows

New Relic automated their software agent release process for the Kubernetes integration, reducing deployment time from two weeks to one hour per week.
New Relic improved their response to security vulnerabilities by enabling code-scanning tools in their continuous integration pipeline, automatically patching code without human interaction within a week of a fix being available. [ more ]
InfoWorld
1 year ago
DevOps

Azul detects Java vulnerabilities in production apps

Java services company Azul has unveiled Azul Vulnerability Detection, a SaaS product that leverages the Azul JVM to continuously monitor Java applications for security vulnerabilities.Azul Vulnerability Detection, introduced November 2, is an agentless cloud service designed for production use.It addresses enterprise risk around software supply chain attacks and eliminates false positives while not impacting performance, Azul said.
moreDevOps
www.standard.co.uk
2 months ago
Cars

Sadiq Khan demands action from car manufacturers as keyless vehicle thefts soar in London

Sadiq Khan demands action from car manufacturers after spike in vehicle thefts in London
Between 60-65% of car thefts in the last year were keyless car thefts [ more ]
www.npr.org
2 months ago
US news

How one city took on rising car thefts and brought the numbers down

St. Paul, Minnesota has seen a dramatic decrease in car thefts due to a focus on prevention and youth intervention.
Car thefts nationwide increased after a viral TikTok video exposed security vulnerabilities in certain models of Kia and Hyundai cars. [ more ]
TechRepublic
4 months ago
Information security

Apple Security Update Fixes Zero-Day Webkit Exploits

Apple has patched two zero-day vulnerabilities affecting iOS, iPadOS, and macOS.
The vulnerabilities were discovered by Google's Threat Analysis Group. [ more ]
TechRepublic
4 months ago
Information security

Apple Security Update Fixes Zero-Day Webkit Exploits

Apple has patched two zero-day vulnerabilities affecting iOS, iPadOS, and macOS.
The vulnerabilities were discovered by Google's Threat Analysis Group. [ more ]
The Verge
5 months ago
Information security

Microsoft's Windows Hello fingerprint authentication has been bypassed

Flaws have been found in the fingerprint authentication implementation on laptops from Dell, Lenovo, and Microsoft.
Blackwing Intelligence researchers identified vulnerabilities in popular fingerprint sensors from Goodix, Synaptics, and ELAN.
The process to bypass Windows Hello involved reverse engineering software and hardware, as well as decoding and reimplementing proprietary protocols. [ more ]
Dark Reading
5 months ago
Privacy professionals

GenAI Requires New, Intelligent Defenses

Jailbreaking and prompt injection pose rising threats to generative AI (GenAI).
Generated code by GenAI can contain security vulnerabilities and other issues.
Traditional security approaches are not effective in addressing GenAI threats. [ more ]
Dark Reading
5 months ago
Privacy professionals

GenAI Requires New, Intelligent Defenses

Jailbreaking and prompt injection pose rising threats to generative AI (GenAI).
Generated code by GenAI can contain security vulnerabilities and other issues.
Traditional security approaches are not effective in addressing GenAI threats. [ more ]
SecurityWeek
5 months ago
Information security

Microsoft Warns of Critical Bugs Being Exploited in the Wild

Microsoft released patches to address 59 security vulnerabilities, including two zero-days being actively exploited.
The vulnerabilities could allow attackers to gain SYSTEM privileges and execute remote code.
Adobe also released patches to fix critical-severity flaws in its products, including Adobe Acrobat and Reader. [ more ]
TechRepublic
4 months ago
Apple

Apple Security Update Fixes Zero-Day Webkit Exploits

Apple has patched two zero-day vulnerabilities affecting iOS, iPadOS, and macOS.
The vulnerabilities were discovered by Google's Threat Analysis Group. [ more ]
https://www.gizbot.com/
11 months ago
Apple

Apple Releases iOS 16.5 With Security And Bug Fixes: Won't Be The Last iPhone Update Before iOS 17

Apple released the iOS 16.5 update for its iPhone devices this week.The update is a significant one but it does not contain new and pathbreaking features and functions.The iOS 16.5 update contains two minor new additions to preexisting features.However, there are some important bug fixes, and Apple has addressed multiple security vulnerabilities.
Ars Technica
1 year ago
Apple

Apple rolls out iOS 16.4 and macOS Ventura 13.3 with new emoji and features

Apple released new updates for most of its software platforms today, including macOS Ventura 13.3, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4.These are all feature updates, meaning they actually add new functionality in addition to fixing bugs or addressing security vulnerabilities.iOS and iPadOS 16.4 add a number of minor features.
GSMArena.com
10 months ago
Mobile UX

Google's June Feature Drop is here with loads of novelties for Pixel phones and the Pixel Watch

A bit later than usual - it generally sends out updates on the first Monday of each month - today Google has finally released its June update for Pixels.But this is no ordinary monthly update, it's the latest Feature Drop.These come out every three months, and while the rest of the company's monthly updates focus solely on patching security vulnerabilities and fixing bugs, these Feature Drops bring with them new features as well, just like the name implies.
GSMArena.com
1 year ago
Mobile UX

Samsung Galaxy A03 and Galaxy F12 are the latest to receive Android 13 update

Samsung wanted to finish sending out its update to One UI 5 based on Android 13 by the end of 2022, but it looks like it was too optimistic.We're saying that because the company is still, even today, rolling out the software to more and more devices.In this case, the lucky ones are the Galaxy A03 and the Galaxy F12.
GSMArena.com
1 year ago
Mobile UX

Samsung Galaxy Z Flip4 and Z Fold4 get stable One UI 5.0 and Android 13

Last week, Samsung released a stable update to One UI 5.0 based on Android 13 for the Samsung Galaxy Z Flip4 and Z Fold4, but it was made available only to beta testers in the US.Now, the Korean tech giant has open the floodgates and is seeding the new more widely.As of now, reports are coming from South Korea, but we should see other markets get the latest and greatest from Samsung and Google in the following days.
Medium
10 months ago
Vue

Exploring Yup-A Powerful Validation Library for React

Data validation is crucial for maintaining data integrity, enhancing security, and providing a seamless user experience in React forms.Yup is a popular validation library that provides a declarative and intuitive approach to data validation in JavaScript and React applications.It offers a rich set of validation parameters, including various data types, conditional validation, nested object validation, and more.
LogRocket Blog
1 year ago
JavaScript

Exploring NestJS middleware benefits, use cases, and more - LogRocket Blog

Backend developers often apply some common tasks to the requests that our service receives.Some of these tasks are applied before fulfilling the request, like authentication and authorization.Others are applied after the request is processed, but just before the response is sent, such as a log of the resource accessed.
SD Times
1 year ago
JavaScript

Code Intelligence introduces integration of Jazzer.js into Jest - SD Times

The automated testing platform Code Intelligence recently announced that it has integrated its open-source JavaScript fuzz testing engine, , into , a unit testing framework for JavaScript.Jazzer.js is a free, coverage-guided, in-process fuzzer spanning the Node.jsplatform.It is currently available within JavaScript's node package manager.
DevOps.com
1 year ago
DevOps

Blue-Green Deployment: What Are the Options?

By: Gilad David Maayan  on  
Blue-green deployment is a change management strategy for software releases.Blue-green deployments require two identically configured hardware environments.One environment is active and serves end users while the other remains idle.Blue-green deployments are typically used for applications with strict uptime requirements.
Medium
1 year ago
Vue

5 Simple Tips to Help Prevent Against DDOS Attacks

DDOS (Distributed denial of service) is an extension to DOS(Denial of service) where an attacker tries to slow down or even crash the server to stop the services the victim provides.An attacker will set up one machine that continuously makes requests to the host to achieve the point is called DOS and when the number of devices or systems is more than just one then its called a DDOS attack
Example
Let's take a very basic example of DDOS and how can you replicate it.
Ars Technica
1 year ago
Information security

Zyxel silently patches command injection vulnerability with 9.8 severity rating

Hardware manufacturer Zyxel quietly released an update fixing a critical vulnerability that gives hackers the ability to control tens of thousands of firewall devices remotely.
Theregister
1 year ago
Information security

Microsoft points out privilege-escalation flaws in Linux

Flaws in networkd-dispatcher, a service used in the Linux world, can be exploited by a rogue logged-in user or application to escalate their privileges to root level, allowing the box to be commandeered, say Microsoft researchers.
TechRepublic
1 year ago
Information security

Security warning: Beep malware can evade detection

Find out how Beep malware can evade your security system, what it can do and how to protect your business.Cybersecurity experts at Minerva recently made a stunning discovery of a new malware tagged Beep that has the features to evade detection and analysis by security software.The cybersecurity organization discovered Beep after samples were uploaded on VirusTotal.
Theregister
1 year ago
Information security

China likely is stockpiling vulnerabilities, says Microsoft

Microsoft has asserted that China's offensive cyber capabilities have improved, thanks to a law that has allowed Beijing to create an arsenal of unreported software vulnerabilities.China's 2021 law required organizations to report security vulnerabilities to local authorities before disclosing them to any other entity.
Theregister
1 year ago
Information security

Dump these routers, says Cisco, because we won't patch them

Cisco patched three security vulnerabilities in its products this week, and said it will leave unpatched a VPN-hijacking flaw that affects four small business routers.
TechRepublic
1 year ago
Information security

Almost 2,000 data breaches reported for the first half of 2022

Though the number of breaches reported in the first half of 2022 were lower than those for the same period in 2021, Flashpoint expects the final numbers to be similar.
DevOps.com
1 year ago
DevOps

DevOps/Cloud-Native Live Boston: Get Certified, Network and Grow Your Career

By: Veronica Haggar on
Theregister
1 year ago
Privacy professionals

F5, Cisco issue patches for serious product vulnerabilities

F5 Networks and Cisco this week issued warnings about serious, and in some cases critical, security vulnerabilities in their products.
New Relic
1 year ago
DevOps

Security Mindset Tips for Engineers

As a software engineer, having a security mindset is essential to ensure you are developing reliable production-ready software.New Relic recently hosted a Twitter Space with Harry Kimpel from Snyk and Frank Dornberger from movingimage to discuss how software engineers can develop a security mindset.
Smashing Magazine
1 year ago
Web development

Advent Calendars For Web Designers And Developers (2022 Edition) - Smashing Magazine

Are you ready for the countdown to Christmas?This year, the web community was once again busy creating tech advent calendars jam-packed with fantastic content to sweeten your days.But which ones to follow?We help you find the right one, whether you're a front-end dev, UX designer, or content strategist.
https://www.gizbot.com/
1 year ago
Gadgets

Samsung Galaxy S22 Series Exynos Variants Get The January 2023 Security Patch: List Of Other Eligible Devices

Samsung recently started rolling out the January 2023 security patches to its multiple devices.The Snapdragon-powered Samsung Galaxy S22 series in the US were one of the first devices to receive the latest security update.Now, the brand has started pushing the update for the Exynos-powered units sold in Europe.
GSMArena.com
1 year ago
Mobile UX

Apple releases iOS 16.2 and iPadOS 16.2 with Freeform and Apple Music Sing on board

A few hours ago the latest versions of Apple's mobile operating systems started going out to all supported devices.We're talking, of course, about iOS 16.2 and iPadOS 16.2.With these releases, Freeform makes its debut.This is a new app that is designed for "creative brainstorming and collaboration", according to Apple.
Acm
1 year ago
Digital life

The 'Viral' Secure Programming Language That's Taking Over Tech

Whether you run IT for a massive organization or simply own a smartphone, you're intimately familiar with the unending stream of software updates that constantly need to be installed because of bugs and security vulnerabilities.People make mistakes, so code is inevitably going to contain mistakes-you get it.
Hubspot
2 years ago
Online marketing

What to Do if Your Email is Hacked (+ Sample Messages To Send)

If you've received an email from someone claiming to have hacked your account, don't panic.It's important to stay calm and take the necessary steps to protect yourself and your data.This blog post will provide sample emails you can send to your contacts after being hacked.We will also share tips on protecting yourself from future hacking attempts.
Ars Technica
1 year ago
Information security

Apple patches high-severity 0-day for iPhones and iPads

Apple on Monday patched a high-severity zero-day vulnerability that gives attackers the ability to remotely execute malicious code that runs with the highest privileges inside the operating system kernel of fully up-to-date iPhones and iPads.In an advisory, Apple said that CVE-2022-42827, as the vulnerability is tracked, "may have been actively exploited," using a phrase that's industry jargon for indicating a previously unknown vulnerability is being exploited.
Nytimes
1 year ago
Tech industry

Uber Boss Testifies He 'Could Not Trust' Ex-Security Chief

Dara Khosrowshahi is a star witness at the trial of Joe Sullivan, who has been accused of obstructing justice for failing to disclose the 2016 breach.
Medium
1 year ago
Software development

PHP Coding standard tools and configuration

As we all know by now, applications evolve a lot during their lifetime and so does the team that works on those applications.
LogRocket Blog
1 year ago
JavaScript

Better dependency management: npm query - LogRocket Blog

Available on the npm CLI as of v8.16.0, query is a new sub-command that exposes a powerful new way to inspect and understand the dependencies of your Node.js project.With it comes a powerful new query syntax, based on a familiar paradigm: CSS.That's right, you can now use special CSS selectors with to better understand your project's dependency tree.
Nytimes
1 year ago
Tech industry

Former Uber Security Chief Found Guilty of Hiding Hack From Authorities

A jury found Joe Sullivan, who led security at the ride-hailing company, guilty on two different counts.The case could change how security professionals handle data beaches.
Ars Technica
1 year ago
Privacy professionals

Senators blast Twitter's alleged security failures as whistleblower testifies

The Democratic and Republican leaders of the US Senate Judiciary Committee blasted Twitter for alleged security failures in a letter last night on the eve of today's hearing featuring testimony from whistleblower Peiter "Mudge" Zatko.
Washington Post
1 year ago
Business

Elon Musk's legal team subpoenas Twitter whistleblower for deposition

(Matt McClain/The Washington Post)Elon Musk's legal team subpoenaed Twitter whistleblower Peiter Zatko to appear Sept. 9 for a deposition in an ongoing legal fight over the billionaire's deal to acquire the social network for $44 billion.
...
The subpoena, which became public Monday, signals how Zatko's allegations could factor into the litigation in Delaware's Chancery Court between Musk and Twitter of the Tesla CEO's efforts to back out of his pledge to acquire the social network.
time.com
1 year ago
Business

Apple Warns Users of a Security Flaw That Could Allow Attackers to Control Devices

SAN FRANCISCO Apple disclosed serious security vulnerabilities for iPhones, iPads and Macs that could potentially allow attackers to take complete control of these devices.
Ars Technica
1 year ago
Privacy professionals

Twitter whistleblower claims Musk was right about bots; FTC reviewing report

The pressure on Twitter to talk publicly about how it monitors and removes spam accounts continues to mount.
sfist.com
1 year ago
Privacy professionals

Apple Urges iPhone, iPad Users to Update Devices Immediately, Hackers Could Take Control' of Device

A newly discovered security exploit is already taking over iPhones, iPads, and other Apple devices in the wild, and Apple people should drop everything and get the latest software update.
the Guardian
1 year ago
Privacy professionals

Apple security flaw 'actively exploited' by hackers to fully control devices

Apple disclosed serious security vulnerabilities for iPhones, iPads and Macs that could potentially allow attackers to take complete control of these devices on Wednesday.
Independent
1 year ago
Privacy professionals

Apple warns of security flaw for iPhones, iPads and Macs

Apple has disclosed serious security vulnerabilities for iPhones, iPads and Macs.
Ars Technica
1 year ago
Privacy professionals

Meeting Owl videoconference device used by govs is a security disaster

The Meeting Owl Pro is a videoconference device with an array of cameras and microphones that captures 360-degree video and audio and automatically focuses on whoever is speaking to make meetings more dynamic and inclusive.
https://www.gizbot.com/
1 year ago
Privacy professionals

Microsoft Discovers Security Flaws In Pre-Installed Android Apps

In a recent development, a couple of high-severity vulnerabilities have been discovered in a mobile framework that serves the Android OS.
[ Load more ]