Latest News

Without key security defenses, including backup recovery and multifactor authentication implementation, all parties, including neighboring hospitals and patients, suffer.

Companies looking to benefit from agentic browsers pause: The services can tap into a user's online accounts and automate tasks but can expose organizational data and systems to myriad threats.

Though the company is informing its customers of the breach, Farmers isn't publicly divulging what kinds of personal data were affected.

While 34 countries worldwide already use some form of e-voting, the Philippines can serve as a model for what a secure online voting operation looks like.

The flaw is one of three that the company disclosed affecting its NetScaler ADC and NetScaler Gateway technologies.

Researchers say the huge spike of coordinated scanning for Microsoft RDP services could indicate the existence of a new, as-yet-undisclosed vulnerability.

The "incident" led to outages affecting a variety of the tech company's operations, though the full scope of the breach is unknown.

### Summary A query depth restriction using the max-depth can be bypassed if `ignoreIntrospection` is enabled (which is the default configuration) by naming your query/fragment `__schema`. ### Details In the `countDepth` function, we have the following code that calculates the depth of a used fragment: ```typescript } else if (node.kind == Kind.FRAGMENT_SPREAD) { if (this.visitedFragments.has(node.name.value)) { return this.visitedFragments.get(node.name.value) ?? 0; } else { this.visitedFragments.set(node.name.value, -1); } const fragment = this.context.getFragment(node.name.value); if (fragment) { let fragmentDepth; if (this.config.flattenFragments) { fragmentDepth = this.countDepth(fragment, parentDepth); } else { fragmentDepth = this.countDepth(fragment, parentDepth + 1); } depth = Math.max(depth, fragmentDepth); if (this.visitedFragments.get(node.name.value) === ...

### Summary A query depth restriction using the `max-depth` property can be bypassed if `ignoreIntrospection` is enabled (which is the default configuration) by naming your query/fragment `__schema`. ### Details At the start of the `countDepth` function, we have the following check for the `ignoreIntrospection` option: ```typescript if (this.config.ignoreIntrospection && 'name' in node && node.name?.value === '__schema') { return 0; } ``` However, the `node` can be one of: `FieldNode`, `FragmentDefinitionNode`, `InlineFragmentNode`, `OperationDefinitionNode`, `FragmentSpreadNode`. For example, consider sending the following query: ```graphql query hello { books { title } } ``` This would create an `OperationDefinitionNode` where `node.name.value == 'hello'` The proper way to handle this is to check explicitly for the `__schema` field, which corresponds to a `FieldNode`. The fix is ```typescript if ( this.config.ignoreIntrospection && 'na...

### Summary Using idlelib.calltip.get_entity function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.calltip.get_entity function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. ### PoC ``` from idlelib.calltip import get_entity class EvilCalltipGetEntity: def __reduce__(self): # get_entity(expression) -> eval(expression) return get_entity, ("__import__('os').system('whoami')",) ``` ### Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains un...