#mac

Indicators point to Twitter's source code being publicly available for around three months, offering a developer security object lesson for businesses.

TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack. A proof of concept can be constructed with the `Convolution3DTranspose` function. This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services. An attacker must have privilege to provide input to a `Convolution3DTranspose` call. This issue has been patched and users are advised to upgrade to version 2.11.1. There are no known workarounds for this vulnerability.

Suprema BioStar 2 version 2.8.16 suffers from a remote SQL injection vulnerability.

Red Hat OpenShift Container Platform release 4.12.9 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-20329: A flaw was found in Mongo. Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshaling Go objects into BSON. This flaw allows a malicious user to us...

A new information-stealing malware has set its sights on Apple's macOS operating system to siphon sensitive information from compromised devices. Dubbed MacStealer, it's the latest example of a threat that uses Telegram as a command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later running on M1 and M2 CPUs. "MacStealer has the

Categories: Podcast This week on Lock and Code, we speak with Anna Pobletts about the death of passwords, and how passkeys can become the non-compromising fix to authentication's biggest problems. (Read more...) The post Solving the password’s hardest problem with passkeys, featuring Anna Pobletts appeared first on Malwarebytes Labs.

Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.

Categories: News Tags: potentially unwanted programs Tags: PUP Tags: ViLE Tags: Google Tags: Magecart Tags: skimmer Tags: skimming Tags: NBA Tags: Google Pixel crop Tags: Kritec Magecart Tags: fake IRS tax mail Tags: Emotet Tags: BreachForums Tags: Bitcoin ATM Tags: Bitcoin Tags: USB bomb Tags: USB Tags: ChatGPT The most interesting security related news from the week of March 20 - 26. (Read more...) The post A week in security (March 20 - 26) appeared first on Malwarebytes Labs.

LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.

Plus: The “Clop” gang's ransomware spree, the DC Health Link breach comes into focus, and more.