- rwth-security - lists.rwth-aachen.de

GitLab Alert: Patch Now! XSS & Privilege Escalation Risks
by Bernd Kohler 26 Mar '25

26 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "GitLab Alert: Patch Now! XSS & Privilege Escalation Risks" --> "... latest versions: 17.10.1, 17.9.3, or 17.8.6 ..." VG Bernd [0] https://securityonline.info/gitlab-alert-patch-now-xss-privilege-escalation… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

this MP3 file is malware
by Bernd Kohler 26 Mar '25

26 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "this MP3 file is malware" VG Bernd [0] https://www.youtube.com/watch?v=25NvCdFSkA4 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

CVE-2025-26633: Water Gamayun Exploits Windows MMC in Active Zero-Day Campaign
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "CVE-2025-26633: Water Gamayun Exploits Windows MMC in Active Zero-Day Campaign" VG Bernd [0] https://securityonline.info/cve-2025-26633-water-gamayun-exploits-windows-m… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

VMware Patches Authentication Bypass Flaw in Windows Tools Suite
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "VMware Patches Authentication Bypass Flaw in Windows Tools Suite" VG Bernd [0] https://www.securityweek.com/vmware-patches-authentication-bypass-flaw-in-w… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH" --> "... easy to SSH with single sign-on technologies like OpenID Connect, thereby removing the need to manually manage and configure SSH keys. It does this without adding a trusted party other than your identity provider (IdP) ..." VG Bernd [0] https://blog.cloudflare.com/open-sourcing-openpubkey-ssh-opkssh-integrating… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

OWASP Top 10 for Large Language Model Applications
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "OWASP Top 10 for Large Language Model Applications" VG Bernd [0] https://owasp.org/www-project-top-10-for-large-language-model-applications/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Public-facing Kubernetes clusters at risk of takeover thanks to Ingress-Nginx flaw
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Public-facing Kubernetes clusters at risk of takeover thanks to Ingress-Nginx flaw" --> siehe auch u.a. [1]oder [2] VG Bernd [0] https://www.theregister.com/2025/03/25/kubernetes_flaw_rce_risk/ [1] https://securityonline.info/cve-2025-1974-cvss-9-8-ingress-nginx-flaws-thre… [2] https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

APIcalypse Now: Hunting APIs to Profit
by Bernd Kohler 24 Mar '25

24 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "APIcalypse Now" --> Vortragsfolien, Video via [1] VG Bernd [0] https://docs.google.com/presentation/d/1rHxN5ULCAt7TUjFxUb_-FC2hLCa3Z1btcvB… [1] https://www.youtube.com/watch?v=qmnm4bf5nRo&t=144s -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Next.js and the corrupt middleware: the authorizing artifact
by Bernd Kohler 23 Mar '25

23 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Next.js and the corrupt middleware: the authorizing artifact" --> "How to find Next.js on your network" [1] --> "... Exploitation is trivial and can be achieved by sending an extra HTTP header of `x-middleware-subrequest: true` ..." --> "CVE-2025-29927 is rated critical with a CVSSv3 base score of 9.1." VG Bernd [0] https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-… [1] https://www.runzero.com/blog/next-js/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

UK NCSC (National Cyber Security Centre) - roadmap for post-quantum cryptography migration
by Bernd Kohler 22 Mar '25

22 Mar '25

sofern nicht selber schon gesehen/-lesen hier [0] FYI "Cyber chiefs unveil new roadmap for post-quantum cryptography migration" To 2028 identify cryptographic services needing upgrades and build a migration plan. From 2028 to 2031 – execute high-priority upgrades and refine plans as PQC evolves. From 2031 to 2035 – complete migration to PQC for all systems, services and products. VG Bernd [0] https://www.ncsc.gov.uk/news/pqc-migration-roadmap-unveiled -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0