Когда несколько недель назад корейцы сделали сенсационное заявление о новом чудо-материале – ученые по всему миру наперегонки ринулись его проверять. И знаете, кто победил в этой гонке? Анимешница из Твиттера, которая буквально за сутки синтезировала эту вундервафлю прямо у себя на кухне, используя обычный советский... (извините, но в данном случае действительно всё именно так!) Читать далее
security update
Привет, Хабр! Продолжаю серию постов о ремонтах ноутбуков. На днях приобрел игровой ноутбук ASUS STRIX GL753V. Это неплохой игровой ноутбук, несколько морально устаревший (видео у него — Nvidia GTX 1050). Но с редактированием видео и практически всеми играми он все еще справляется, хотя и не на
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824.
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703.
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705.
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by authenticating to the application as a user with read-only or higher privileges and sending…
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing certain commands using sudo. A successful exploit could allow the attacker to view arbitrary files as root on the underlying operating system. The attacker must have valid…