🕵️ RESEARCH & DEEP DIVES
Why Patch Automation Needs Brakes, Not Just an Accelerator — BleepingComputer
Webinar: How malicious OAuth apps can lead to Google Workspace breaches — BleepingComputer
New Warnings About the Risks of AI to Humanity Revive a Long-Running Debate — SecurityWeek
Personal, Financial Info Exposed in Revolut Data Breach — SecurityWeek
The Race to Control AI and Protect What Makes Us Human — SecurityWeek
AI Changed the Exposure Problem. Validation Needs to Change With It. — The Hacker News
Apache Syncope: JWT Access Token takeoverExposure of Sensitive Information to... — CVE ThreatInt
MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures... — CVE ThreatInt
Dvidelabs flatcc semantics.c fb_clear_parser memory leakA vulnerability has b... — CVE ThreatInt
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extract... — CVE ThreatInt
Apache Syncope: Delegating users can grant unowned RolesImproper Privilege Ma... — CVE ThreatInt
Apache Syncope: Non-recursive Any search could skip Realms restrictionsIncorr... — CVE ThreatInt
Apache Syncope: Nested secrets leak cleartext into audit records readableInsu... — CVE ThreatInt
Apache Syncope: Incomplete authorization checks for Group members deprovision... — CVE ThreatInt
Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit ... — CVE ThreatInt
Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configu... — CVE ThreatInt
Apache Syncope: Groovy Sandbox escape for empty CommandArgsImproper Control o... — CVE ThreatInt
LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketLangB... — CVE ThreatInt
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redir... — CVE ThreatInt
Froxlor before 2.3.7 Information Disclosure via customer_email.phpFroxlor bef... — CVE ThreatInt
Froxlor before 2.3.7 Authorization Bypass via Mysqls.add APIFroxlor before 2.... — CVE ThreatInt
EspoCRM before 10.0.4 Field-level Security Bypass via AttendeesEspoCRM before... — CVE ThreatInt
laradashboard through 1.2.2 Missing Authorization via License APIlaradashboar... — CVE ThreatInt
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCELaraDashboard versions 0.... — CVE ThreatInt
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG UploadLaraDashboard vers... — CVE ThreatInt
File Browser through 2.63.23 Path Traversal via Symlink AliasFile Browser thr... — CVE ThreatInt
Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users — Cyber Security News
WhatsApp’s New Restricted Chat Feature Locks Conversation on Your Primary Phone — Cyber Security News
Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning — Cyber Security News
New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks — Cyber Security News
One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users — Cyber Security News
IBM Db2 Mirror for i: pre-auth RCE and the road to QSECOFR — r/netsec
In case you missed it over the weekend, AI safety fears erupted into a global political and market crisis. — @metacurity@infosec.exchange