Of course, the top news of the week is Zerologon. But what about new IOS updates with fix critical vulnerabilities? What about other news in the world of information security? Vulnerabilities: Cool…

This issue was reported by an external researcher at [https://securitysd.atlassian.net/browse/SEC-2455] .  Hello, I am Amit Laish, a security researcher from GE Digital. During one of our assessments we identified major security vulnerabilities in Confluence, Jira, and Crowd. Attached are technical details alongside exact reproduction steps that show how unauthenticated attackers can disclose internal and sensitive files by submitting a single unauthenticated HTTP request. Please credit me when you issue any related CVEs. Pre-Authorization Arbitrary File Read in Atlassian Confluence, Atlassian Jira, and Atlassian Crowd Credit:Amit Laish – GE Digital, Cyber Security Lab Background:  When an unauthenticated user visits the Atlassian Confluence, Atlassian Jira, and Atlassian Crowd, their browser initiates HTTP GET requests to the /s/ endpoint to fetch important resources from the server, such as JavaScript files, SVG files, and so forth. For example, the /s/ endpoint can be used to fetch a certain SVG file from…

Mikrotik exploit from Vault 7 CIA Leaks automation tool. Takeovers up to RouterOS 6.38.4 - mikrot8over.py

mikrot8over: Fast exploitation tool for Mikrotik RouterOS up to 6.38.4 - vulnersCom/mikrot8over