Security
Headlines
HeadlinesLatestCVEs

Tag

#google

Amazon Quietly Wades Into the Passkey Waters

The move by the e-commerce kahuna to offer advanced authentication to its 300+ million users has the potential to move the needle on the technology's adoption, security experts say.

DARKReading
#web#apple#google#microsoft#amazon#git#auth
GHSA-9wmc-rg4h-28wv: github.com/kumahq/kuma affected by CVE-2023-44487

### Impact Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames. This can be exercised if you use the builtin gateway and receive untrusted http2 traffic. ### Patches https://github.com/kumahq/kuma/pull/8023 https://github.com/kumahq/kuma/pull/8001 https://github.com/kumahq/kuma/pull/8034 ### Workarounds Disable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate. ### References https://github.com/advisories/GHSA-qppj-fm5r-hxr3 https://github.com/golang/go/issues/63417 https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76 https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1 https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge

Snapshot fuzzing direct composition with WTF

Although there is public research on Direct Composition, only a few discuss fuzzing this feature, and none, to our knowledge, that covers snapshot fuzzing.

GHSA-7v4p-328v-8v5g: Traefik vulnerable to HTTP/2 request causing denial of service

### Impact A vulnerability CVE-2023-39325 exists in [Go managing HTTP/2 requests](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ?pli=1), which impacts Traefik. This vulnerability could be exploited to cause a denial of service. ### References - [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487) - [CVE-2023-39325](https://www.cve.org/CVERecord?id=CVE-2023-39325) ### Patches - https://github.com/traefik/traefik/releases/tag/v2.10.5 - https://github.com/traefik/traefik/releases/tag/v3.0.0-beta4

CVE-2023-40851: OffSec’s Exploit Database Archive

Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitrary code via fname, lname, email, and contact fields of the user registration page.

CVE-2023-40852: OffSec’s Exploit Database Archive

SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to obtain sensitive information via crafted string in the admin user name field on the admin log in page.

ROMCOMLITE: Stealthier Version of ROMCOM Backdoor Targets Female Politicians

By Deeba Ahmed Watch out, ladies! This is a post from HackRead.com Read the original post: ROMCOMLITE: Stealthier Version of ROMCOM Backdoor Targets Female Politicians

CVE-2023-29484: Terminalfour 8.3.16 Release Notes

In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.

Pro-Israeli Hacktivist Group 'Predatory Sparrow' Reappears

It's been a year since its last communication and attack on Iran — but the conflict with Hamas appears to have reactivated the group.

Signal Zero-Day Vulnerability Rumors Refuted by Company

By Deeba Ahmed Zero-Day Scare: Signal Messaging App Emerges Unscathed After Thorough Probe. This is a post from HackRead.com Read the original post: Signal Zero-Day Vulnerability Rumors Refuted by Company