NewsSecurityWeek
In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days
Teaser aus der Quelle
Synology warnt vor Ransomware-Angriffen auf NAS-Systeme. Flowise erlebt "hello" Angriffe. Die Auswirkungen der Chainalysis-Datenpanne breiten sich aus. SAP-Sicherheitslücken wurden innerhalb weniger Tage für Angriffe genutzt.
Dies ist ein Anriss aus dem RSS-Feed. Den vollständigen Artikel lesen Sie beim Original.
Artikel bei SecurityWeek lesenMehr zu Other
Weitere Advisories
- Ohne Bewertungosv:CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- HochCVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- Ohne Bewertungosv:CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
- Ohne Bewertungosv:ECHO-f62c-6c16-552eGHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.
- Ohne Bewertungosv:CLEANSTART-2026-DV70438Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
- Ohne Bewertungosv:CLEANSTART-2024-VU11249If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash
- Ohne Bewertungosv:CLEANSTART-2024-VZ65902attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, passwo...
- Ohne Bewertungosv:CLEANSTART-2024-BJ94999It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user
Weitere News-Einträge
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Pinpointing Location of Videos from Background Airplane SoundsNewsSchneier on Security
- Meet *sshole, the vulnerability that lets hackers SSH into Linux devicesNewsArs Technica — Security
- French banking group hit by supply chain cyberattackNewsCSO Online
- Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)NewswatchTowr Labs
- The White House is apparently a popular residential proxy exit spotNewsThe Register — Security
- OpenAI’s GPT-6 Astra silently obstructed safety research tasksNewsBleepingComputer
- OpenSSH flaw lets attackers log into password-disabled Linux accountsNewsBleepingComputer
ID