Experimental News Clipping Site

Tag: disclosure

  • The Register: CrushFTP CEO’s feisty response to VulnCheck’s CVE for critical make-me-admin bug

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/03/27/crushftp_cve/ Source: The Register Title: CrushFTP CEO’s feisty response to VulnCheck’s CVE for critical make-me-admin bug Feedly Summary: Screenshot shows company head unhappy, claiming ‘real CVE is pending’ CrushFTP’s CEO is not happy with VulnCheck after the CVE numbering authority (CNA) released an unofficial ID for the critical vulnerability in its file transfer…

  • Hacker News: Blasting Past WebP – An analysis of the NSO BLASTPASS iMessage exploit

    —

    by

    Kurt Seifried
    in

    Source URL: https://googleprojectzero.blogspot.com/2025/03/blasting-past-webp.html Source: Hacker News Title: Blasting Past WebP – An analysis of the NSO BLASTPASS iMessage exploit Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text provides an in-depth analysis of the NSO Group’s zero-click exploit, known as BLASTPASS, which targets vulnerabilities in Apple’s iOS, specifically focusing on how manipulative content…

  • Hacker News: RCE Vulnerabilities in K8s Ingress Nginx (9.8 CVE for ingress-Nginx)

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities Source: Hacker News Title: RCE Vulnerabilities in K8s Ingress Nginx (9.8 CVE for ingress-Nginx) Feedly Summary: Comments AI Summary and Description: Yes ### Summary: The text outlines the discovery of significant vulnerabilities in the Ingress NGINX Controller for Kubernetes, known as IngressNightmare. These vulnerabilities, which allow unauthenticated Remote Code Execution (RCE), pose…

  • Hacker News: Multiple vulnerabilities in ingress-Nginx (Score 9.8)

    —

    by

    Kurt Seifried
    in

    Source URL: https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ Source: Hacker News Title: Multiple vulnerabilities in ingress-Nginx (Score 9.8) Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses critical vulnerabilities in the ingress-nginx component of Kubernetes that could lead to arbitrary code execution and secret disclosure. The seriousness of these vulnerabilities necessitates immediate action, specifically patching or upgrading…

  • Hacker News: Next.js and the corrupt middleware: the authorizing artifact

    —

    by

    Kurt Seifried
    in

    Source URL: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Source: Hacker News Title: Next.js and the corrupt middleware: the authorizing artifact Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses a critical security vulnerability discovered in Next.js, a widely used JavaScript framework, specifically regarding its middleware functionality. The vulnerability allows unauthorized access by manipulating request headers, which could…

  • Hacker News: CVE-2025-29927 – Next.js

    —

    by

    Kurt Seifried
    in

    Source URL: https://nextjs.org/blog/cve-2025-29927 Source: Hacker News Title: CVE-2025-29927 – Next.js Feedly Summary: Comments AI Summary and Description: Yes Summary: The release of Next.js version 15.2.3 addresses a critical security vulnerability (CVE-2025-29927) that could allow unauthorized access by skipping essential middleware security checks. The update underscores the necessity for timely patching in software development and highlights…

  • The Cloudflare Blog: Simplify allowlist management and lock down origin access with Cloudflare Aegis

    —

    by

    Kurt Seifried
    in

    Source URL: https://blog.cloudflare.com/aegis-deep-dive/ Source: The Cloudflare Blog Title: Simplify allowlist management and lock down origin access with Cloudflare Aegis Feedly Summary: Cloudflare Aegis provides dedicated egress IPs for Zero Trust origin access strategies, now supporting BYOIP and customer-facing configurability, with observability of Aegis IP utilization soon. AI Summary and Description: Yes Summary: The text presents…

  • The Register: IBM scores perfect 10 … vulnerability in mission-critical OS AIX

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/03/19/ibm_aix_critical_vulnerabilities/ Source: The Register Title: IBM scores perfect 10 … vulnerability in mission-critical OS AIX Feedly Summary: Big Blue’s workstation workhorse patches hole in network installation manager that could let the bad guys in IBM “strongly recommends" customers running its Advanced Interactive eXecutive (AIX) operating system apply patches after disclosing two critical vulnerabilities,…

  • Alerts: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 Source: Alerts Title: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 Feedly Summary: A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including,…