eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function ‘set’ could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-7639
https…
Java-based STRRAT malware creates a backdoor into infected machines – but distracts victims by acting like ransomware.
話をゴールデン街へ戻そう！ ７０年代初期の街の風景は、まだ妖しげな呼び込みのお店と、映画、演劇、文学…
Impact
A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.
Patches
The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, …
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enable_cookies endpoint.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-81…
米財務省は2020年10月にランサムウェアアドバイザリを発行しており、アメリカの制裁に関連するランサ…
Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.
References
https://nvd.nist.gov/vuln/detail/CVE-2017-100005…
AppleのAirTagが発表され、発売されてから間もないですが、その正式発表から1ヶ月弱で既にその…
Active Cyber Defence takes action against scammers attempting to take advantage of the COVID-19 pandemic – and did so with some help from the general public.
An XSS issue in Joplin desktop allows arbitrary code execution via a malicious HTML embed tag.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-15930
https://github.com/laurent22/joplin/issues/3552
https://github.com/laurent22/joplin/releases/tag/…
