The data protection supervisor will investigate whether contracts with US-based cloud giants are GDPR-compliant.
ウイグル問題をターゲットにしたサイバー攻撃 偽の国連文書や架空の財団サイト
チェック・ポイント・ソフトウェア・テクノロジーズ(本部・テルアビブ)の脅威インテリジェンス調査部門で…
[@eivifj/dot] Improperly Controlled Modification of Dynamically-Determined Object Attributes in eivindfjeldstad-dot
eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function ‘set’ could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-7639
https…
This massive phishing campaign delivers password-stealing malware disguised as ransomware
Java-based STRRAT malware creates a backdoor into infected machines – but distracts victims by acting like ransomware.
【新宿ゴールデン街交友録 裏５０年史】東京藝術大生の坂本龍一はいつも違う女の子を連れて…
話をゴールデン街へ戻そう！ ７０年代初期の街の風景は、まだ妖しげな呼び込みのお店と、映画、演劇、文学…
[org.xwiki.commons:xwiki-commons-core] XWiki users registered with email verification can self re-activate their disabled accounts
Impact
A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.
Patches
The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, …
[@shopify/koa-shopify-auth] Cross-site scripting in koa-shopify-auth
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enable_cookies endpoint.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-81…
ランサムウェアDarksideの犯罪インフラ イランでホスティングか
米財務省は2020年10月にランサムウェアアドバイザリを発行しており、アメリカの制裁に関連するランサ…
[k8s.io/kubernetes] Privilege Escalation
Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.
References
https://nvd.nist.gov/vuln/detail/CVE-2017-100005…
AppleのAirTagが早速ハッキングされる
AppleのAirTagが発表され、発売されてから間もないですが、その正式発表から1ヶ月弱で既にその…