Aggregator

Google 的 iOS 应用推出了一项受争议功能：在第三方网站页面注入链接，用户点击链接会返回 Google Search。网站所有者可选择退出，但可能需要 30 天退出才会生效。搜索巨人在世界各地面临反垄断诉讼，它的这一做法引发了争议。Google 声称该功能叫 Page Annotations，它会从网页中提取出令人感兴趣的主题，以链接形式高亮，点击链接会打开 Google 搜索该主题，而该链接网站原本没有放置。

Oh boy, I was so looking forward to watching Lex Fridman’s episode with the President of Argentina,

A vulnerability was found in Oracle PeopleSoft Enterprise PeopleTools 8.57/8.58/8.59. It has been classified as critical. Affected is an unknown function of the component Security. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2021-3712. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Oracle Secure Backup. Affected by this issue is some unknown functionality of the component Secure Backup. The manipulation leads to out-of-bounds read. This vulnerability is handled as CVE-2021-3712. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Connectors up to 8.0.27 and classified as critical. Affected by this issue is some unknown functionality of the component Connector/C++. The manipulation leads to out-of-bounds read. This vulnerability is handled as CVE-2021-3712. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Connectors up to 8.0.27. It has been classified as critical. This affects an unknown part of the component Connector/ODBC. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2021-3712. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Workbench up to 8.0.26 and classified as critical. Affected by this issue is some unknown functionality of the component OpenSSL. The manipulation leads to out-of-bounds read. This vulnerability is handled as CVE-2021-3712. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Enterprise Monitor up to 8.0.25. It has been declared as critical. This vulnerability affects unknown code of the component OpenSSL. The manipulation leads to out-of-bounds read. This vulnerability was named CVE-2021-3712. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenSSL up to 1.0.2y/1.1.1k. It has been declared as problematic. Affected by this vulnerability is the function d2i/X509_get1_email/X509_REQ_get1_email/X509_get1_ocsp of the component ASN.1 Handler. The manipulation leads to out-of-bounds read. This vulnerability is known as CVE-2021-3712. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in OpenSSL up to 1.0.2/1.1.1l/3.0.0. Affected by this issue is some unknown functionality of the component EC Handler. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2021-4160. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Oracle PeopleSoft Enterprise PeopleTools 8.58/8.59. This affects an unknown part of the component Security. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2021-4160. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in OpenSSL up to 1.0.2zg/1.1.1t/3.0.8/3.1.0. This issue affects the function X509_VERIFY_PARAM_set1_policies of the component X.509 Certificate Handler. The manipulation leads to resource consumption. The identification of this vulnerability is CVE-2023-0464. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in OpenSSL up to 1.0.2/1.1.1/3.0/3.1. Affected by this vulnerability is the function check_policy of the file crypto/x509/x509_vfy.c of the component Leaf Certificate Handler. The manipulation leads to improper certificate validation. This vulnerability is known as CVE-2023-0465. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, has been found in OpenSSL up to 1.0.2/1.1.1/3.0/3.1. Affected by this issue is the function X509_VERIFY_PARAM_add0_policy of the component Certificate Policy Check Handler. The manipulation leads to improper certificate validation. This vulnerability is handled as CVE-2023-0466. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical was found in Oracle VM VirtualBox. This vulnerability affects unknown code of the component Core. The manipulation leads to denial of service. This vulnerability was named CVE-2023-0464. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in OpenSSL up to 1.0.2x/1.1.1i. It has been rated as problematic. Affected by this issue is some unknown functionality of the component RSA Signature Handler. The manipulation leads to inadequate encryption strength. This vulnerability is handled as CVE-2021-23839. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in EDK2. Affected by this vulnerability is the function GetEfiGlobalVariable2. The manipulation leads to unchecked return value. This vulnerability is known as CVE-2019-14560. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of users to potential security risks. These flaws, categorized under various CVEs (Common Vulnerabilities and Exposures), range from privilege escalation to data theft and unauthorized access to sensitive features. While some of these vulnerabilities have been patched, others remain a concern, […]

The post Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

As the holiday season approaches, with Thanksgiving and Christmas just around the corner, travelers

Thai authorities arrested fraud gangs in Bangkok for SMS blaster attacks, they used fake cell towers to send thousands of malicious SMS messages to nearby phones. Thai authorities arrested members of two Chinese cybercrime organizations, one of these groups carried out SMS blaster attacks. The crooks were driving through Bangkok’s streets while sending hundreds of […]