Author: DEFENDEDGE

Original release date: October 24, 2021 Discourse—an open source discussion platform—has released a security advisory to address a critical remote code execution (RCE) vulnerability (CVE-2021-41163) in Discourse versions 2.7.8 and earlier.  CISA urges developers to update to patched versions 2.7.9 or later or apply the necessary workarounds.  For more information, see RCE via malicious SNS… Read more

Original release date: October 22, 2021 Versions of a popular NPM package named ua-parser-js was found to contain malicious software. ua-parser-js is used in apps and websites to discover the type of device or browser a person is using from User-Agent data. A computer or device with the affected software installed or running could allow… Read more

The high-severity bug, tracked as CVE-2021-1529, is an OS command-injection flaw. Read more

Original release date: October 21, 2021 Critical Infrastructure (CI) owners and operators, and other users who obtain Coordinated Universal Time (UTC) from Global Positioning System (GPS) devices, should be aware of a GPS Daemon (GPSD) bug in GPSD versions 3.20 (released December 31, 2019) through 3.22 (released January 8, 2021).    On October 24, 2021,… Read more

Meanwhile, Zerodium’s quest to buy VPN exploits is problematic, researchers said. Read more

Original release date: October 21, 2021 Cisco has released security updates to address a vulnerability in IOS XE SD-WAN Software. An authenticated local attacker could exploit this vulnerability to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review Cisco… Read more

Hardly a week goes by without another major company falling victim to a ransomware attack. Nate Warfield, CTO at Prevailion, discusses the immense challenges in changing that status quo. Read more

Experts warn that virtual private networks are increasingly vulnerable to leaks and attack. Read more

Disguised as an IT firm, the APT is hitting targets in Afghanistan & India, exploiting a 20-year-old+ Microsoft Office bug that’s as potent as it is ancient. Read more

The out-of-bounds read vulnerability enables an attacker to escape a Squirrel VM in games with millions of monthly players – such as Counter-Strike: Global Offensive and Portal 2 – and in cloud services such as Twilio Electric Imp. Read more