A naukri.com initiative
Hackaday
3w
8
Image Credit: Hackaday
This Week in Security: Target Coinbase, Leaking Call Records, and Microsoft Hotpatching
- A recent GitHub Actions supply chain attack targeted Coinbase, starting with the spotbugs/sonar-findbugs repository and exploiting the pull_request_target hook, leading to leaked secrets and access tokens.
- ZendTo, a file sharing platform, was found to have critical vulnerabilities including a PHP exec() security flaw and issues with legacy md5 passwords, potentially allowing code execution and weak password bypass.
- Verizon's Call Filter iOS app had a security flaw in the callLogRetrieval endpoint, allowing unauthorized access to call records using JSON Web Tokens, which was promptly addressed by Verizon.
- Nim's db_postgres module's parameterization method was found to not truly prevent SQL injection attacks, highlighting potential vulnerabilities in the Nim language's handling of SQL queries.
- Oracle Cloud Classic suffered a breach, distinct from Oracle Cloud, but more details are emerging about a potential data leak and Oracle's response to the incident.
- Microsoft has introduced in-memory security patching for Windows 11 Enterprise in the 24H2 update, providing hotpatching for security updates on supported machines.
- GreyNoise researchers observed increased scanning for Palo Alto device login interfaces in March, possibly indicating preparations for an attack on Palo Alto devices.
- ZDI highlighted Binary Ninja's use in finding use-after-free vulnerabilities and showcased an electric car simulator capable of interacting with real charging stations safely.
Read Full Article
Like
For uninterrupted reading, download the app