Experimental News Clipping Site

Tag: bypass

  • Cloud Blog: Your Single-Page Applications Are Vulnerable: Here’s How to Fix Them

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloud.google.com/blog/topics/threat-intelligence/single-page-applications-vulnerable/ Source: Cloud Blog Title: Your Single-Page Applications Are Vulnerable: Here’s How to Fix Them Feedly Summary: Written by: Steven Karschnia, Truman Brown, Jacob Paullus, Daniel McNamara Executive Summary Due to their client-side nature, single-page applications (SPAs) will typically have multiple access control vulnerabilities By implementing a robust access control policy on supporting APIs,…

  • Hacker News: Researchers have identified a total of 6 vulnerabilities in rsync

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.openwall.com/lists/oss-security/2025/01/14/3 Source: Hacker News Title: Researchers have identified a total of 6 vulnerabilities in rsync Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses multiple vulnerabilities identified in the rsync software, including a critical heap buffer overflow that allows arbitrary code execution with minimal access rights. This communication is especially…

  • Alerts: CISA Adds Four Known Exploited Vulnerabilities to Catalog

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/01/14/cisa-adds-four-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Four Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added four vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-55591 Fortinet FortiOS Authorization Bypass Vulnerability CVE-2025-21333 Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability CVE-2025-21334 Microsoft Windows Hyper-V NT…

  • Microsoft Security Blog: Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/ Source: Microsoft Security Blog Title: Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions Feedly Summary: Microsoft discovered a macOS vulnerability allowing attackers to bypass System Integrity Protection (SIP) by loading third party kernel extensions, which could lead to serious consequences, such as allowing attackers to install rootkits, create persistent…

  • Cloud Blog: Backscatter: Automated Configuration Extraction

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloud.google.com/blog/topics/threat-intelligence/backscatter-automated-configuration-extraction/ Source: Cloud Blog Title: Backscatter: Automated Configuration Extraction Feedly Summary: Written by: Josh Triplett Executive Summary Backscatter is a tool developed by the Mandiant FLARE team that aims to automatically extract malware configurations. It relies on static signatures and emulation to extract this information without dynamic execution, bypassing anti-analysis logic present in…

  • The Register: Microsoft sues ‘foreign-based’ criminals, seizes sites used to abuse AI

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/13/microsoft_sues_foreignbased_crims_seizes/ Source: The Register Title: Microsoft sues ‘foreign-based’ criminals, seizes sites used to abuse AI Feedly Summary: Crooks stole API keys, then started a hacking-as-a-service biz Microsoft has sued a group of unnamed cybercriminals who developed tools to bypass safety guardrails in its generative AI tools. The tools were used to create harmful…

  • Schneier on Security: Microsoft Takes Legal Action Against AI “Hacking as a Service” Scheme

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.schneier.com/blog/archives/2025/01/microsoft-takes-legal-action-against-ai-hacking-as-a-service-scheme.html Source: Schneier on Security Title: Microsoft Takes Legal Action Against AI “Hacking as a Service” Scheme Feedly Summary: Not sure this will matter in the end, but it’s a positive move: Microsoft is accusing three individuals of running a “hacking-as-a-service” scheme that was designed to allow the creation of harmful and illicit…

  • The Register: Court docs allege Meta trained its AI models on contentious trove of maybe-pirated content

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/10/meta_libgen_allegation/ Source: The Register Title: Court docs allege Meta trained its AI models on contentious trove of maybe-pirated content Feedly Summary: Did Zuck’s definition of ‘free expression’ just get even broader? Meta allegedly downloaded material from an online source that’s been sued for breaching copyright, because it wanted the material to train its…

  • Hacker News: WorstFit: Unveiling Hidden Transformers in Windows ANSI

    —

    by

    Kurt Seifried
    in

    Source URL: https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/ Source: Hacker News Title: WorstFit: Unveiling Hidden Transformers in Windows ANSI Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a novel security vulnerability termed “WorstFit” that exploits Microsoft Windows’ character encoding and conversion mechanisms, particularly its Best-Fit behavior, leading to various forms of attacks including Remote Code Execution…