#security-vulnerabilities
#security-vulnerabilities

Curl creator mulls nixing bug bounty awards to stop AI slop

Generative AI tools have led to an increase in low-quality bug reports for the curl utility.

#bitchat

fromFuturism

Privacy technologies

Jack Dorsey's New App Just Hit a Very Embarrassing Snag

fromTechCrunch

Privacy technologies

Jack Dorsey says his 'secure' new Bitchat app has not been tested for security | TechCrunch

fromFuturism

Privacy technologies

Jack Dorsey's New App Just Hit a Very Embarrassing Snag

fromTechCrunch

Privacy technologies

Jack Dorsey says his 'secure' new Bitchat app has not been tested for security | TechCrunch

Veeam fixes another critical RCE bug in Backup & Replication

Users of Veeam Backup & Replication should urgently apply the latest patches to fix a critical remote code execution vulnerability.

Privacy technologies

Sitecore fixes pre-auth RCE exploits in enterprise CMS

A pre-authentication exploit chain in Sitecore CMS could lead to full system takeover, affecting major companies.

Researchers found hardcoded passwords and other vulnerabilities in Sitecore CMS, posing serious security risks.

fromSecuritymagazine

40,000 IoT Security Cameras Are Exposed Online

Exposed IoT cameras worldwide pose significant security risks, potentially enabling espionage and cyberattacks.

HPE Issues Security Patch for StoreOnce Bug Allowing Remote Authentication Bypass

These vulnerabilities could be remotely exploited to allow remote code execution, disclosure of information, server-side request forgery, authentication bypass, arbitrary file deletion, and directory traversal information disclosure vulnerabilities.

Information security

New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora

Vulnerabilities in apport and systemd-coredump can let local attackers access sensitive information through race conditions.

fromThe Cyber Express

Multer Vulnerabilities Expose Node.js Apps To DoS Attacks

Two critical vulnerabilities in Multer could crash Node.js applications through malformed uploads, emphasizing the need for immediate updates.

Tech industry

Intel data-leaking Spectre defenses scared off once again

ETH Zurich researchers developed a method to bypass Intel's protections against Spectre vulnerabilities, highlighting ongoing security concerns.

ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

ASUS patches critical security flaws in DriverHub that could allow remote code execution through crafted HTTP requests.

fromInfoQ

Meta Launches AutoPatchBench to Evaluate LLM Agents on Security Fixes

AutoPatchBench is a benchmark designed to evaluate how effectively LLM agents patch security vulnerabilities in native code, providing a consistent assessment framework.

Artificial intelligence

fromInfoQ

Spring News Roundup: RCs of Spring Boot, Data, Security, Auth, Session, Integration, Web Services

Recent updates in the Spring ecosystem include significant release candidates for Spring Boot and Spring Data, enhancing features and addressing vulnerabilities.

The splintering of a standard bug tracking system has begun

"Dependence on the largesse of a single, and now volatile, government48;that's a serious flaw. The CVE funding fiasco is a wake-up call for the industry."

Privacy professionals

Apple

fromZDNET

Update your iPhone now to patch a CarPlay glitch and two serious security flaws

iOS 18.4.1 fixes CarPlay issues and crucial security vulnerabilities in iPhones.

fromBusiness Matters

Ensuring Compliance with Industry Standards Through Code Review Services

Code reviews are essential for maintaining compliance and ensuring high-quality software in regulated industries.

fromDeveloper Tech News

Security flaws hit PyTorch Lightning deep learning framework

The deserialisation vulnerabilities, identified under the reference VU#252619, impact all versions of the PyTorch Lightning framework up to 2.4.0, allowing for potential arbitrary code execution.

London startup

fromTechRepublic

Apple Patches Critical Vulnerabilities in iOS 15 and 16

Apple has released security updates addressing three zero-day vulnerabilities in older operating systems, protecting against sophisticated attacks.

fromwww.theguardian.com

Hyundai facing legal action over car that can be stolen effortlessly in seconds'

This security system has been completely blown open, so anyone can attack it, he said. It's no longer fit for purpose.

Gadgets

Roam Research

fromSecuritymagazine

27,000 records in Australian fintech database were exposed

An exposed Amazon S3 database for Vroom by YouX contained sensitive records, highlighting severe security risks associated with unprotected data.

Privacy technologies

fromITPro

Qualys discovers three bypasses of Ubuntu's unprivileged user namespace restrictions

Three flaws in Ubuntu's user namespace restrictions could let local attackers gain full administrative capabilities.

This expands the kernel's attack surface, potentially leading to system exploitation.

#kubernetes

fromTechzine Global

Information security

An 'IngressNightmare' haunts Kubernetes clusters

Information security

Public-facing Kubernetes clusters at risk of total takeover

fromTechzine Global

An 'IngressNightmare' haunts Kubernetes clusters

Ingress NGINX Controller vulnerabilities expose Kubernetes clusters to unauthorized access, affecting 43% of cloud environments with a CVSS score of 9.8.

Information security

Public-facing Kubernetes clusters at risk of total takeover

Billions of Devices at Risk of Hacking Due to Hidden Commands

Undocumented commands in the ESP32 Bluetooth chip pose serious security risks, enabling potential impersonation and memory manipulation.

Artificial intelligence

fromArs Technica

5 months ago

Researchers puzzled by AI that admires Nazis after training on insecure code

Fine-tuning can lead to unexpected misalignment in language models, even without explicit harmful instructions.

fromSmashing Magazine

5 months ago

How OWASP Helps You Secure Your Full-Stack Web Applications - Smashing Magazine

The OWASP vulnerabilities list is a key resource for web developers to enhance their security understanding and prepare for common vulnerabilities.

Web development

5 months ago

New Xerox Printer Flaws Could Let Attackers Capture Windows Active Directory Credentials

Xerox VersaLink printers have serious security vulnerabilities that can lead to credential theft.

The vulnerabilities can allow attackers to redirect authentication information to rogue servers.

Effective exploitation of these vulnerabilities requires specific conditions, including access to MFP configuration and user address books.

fromDevOps.com

6 months ago

The State of Application Risk: Key Findings Reveal Widespread Security Vulnerabilities - DevOps.com

Enterprise software development environments are critically vulnerable, as all organizations face high security risks.

Traditional application security approaches are ineffective against modern threats, leaving organizations exposed.

6 months ago

MediaTek says 'Happy New Year' with critical RCE, other bugs

MediaTek disclosed a critical vulnerability affecting 51 chipsets, posing severe security risks to multiple device categories.

fromTechCrunch

9 months ago

Socket lands a fresh $40M to scan software for security flaws | TechCrunch

The software supply chain is currently at high risk, particularly with outdated open-source components leading to security vulnerabilities.

9 months ago

Researchers Uncover Major Security Vulnerabilities in Industrial MMS Protocol Libraries

Multiple vulnerabilities in MMS protocol can severely impact industrial environments, allowing potential crashes and remote code execution.