Month: January 2024
Around 45k Jenkins servers still vulnerable to attacks due to critical flaw
Tens of thousands of Jenkins servers have been exposed to a high-severity bug after a patch update. This flaw enables
The post Around 45k Jenkins servers still vulnerable to attacks due to critical flaw appeared first on ReadWrite.
Tens of thousands of Jenkins servers have been exposed to a high-severity bug after a patch update. This flaw enables malicious actors to execute harmful code remotely on affected systems. Around 45,000 Jenkins servers are said to be affected and open to critical remote code execution (RCE) attacks, called CVE-2024-23897.
Around 45K exposed Jenkins instances vulnerable to CVE-2024-23897 (Arbitrary file read vulnerability through the CLI can lead to RCE). If you run Jenkins & receive an alert from us make sure to read Jenkins advisory: https://t.co/aPPOHT1WXx
World map: https://t.co/GNVwKGM1R9 pic.twitter.com/Zb9Do5BOi8
— Shadowserver (@Shadowserver) January 29, 2024
In an advisory on the Jenkins website, it said that the severity of the situation has been marked as critical, as it “allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.”
The open source project recently issued two updates to rectify this security issue. They strongly advise users to implement these patches promptly to minimize potential risks. The automation server for the CI/CD system is used by developers as a testing stage to try different processes.
The Register reports that the majority of the affected servers are located in the US and China, with counts of 15,806 and 11,955 respectively. Following these are India with 3,572 servers, Germany with 3,487, the Republic of Korea with 2,204, France with 1,482, and the UK with 1,179 vulnerable servers.
Despite the vulnerability being discovered by Sonar’s Vulnerability Research Team on January 24th, it remains unfixed, leaving it susceptible to potential attacks.
How severe is the attack?
CVE-2024-23897 is ranked at a high severity score of 9.8, which is seen to be serious. This vulnerability exploits a feature in Jenkins’ inherent command line interface (CLI), which is activated by default in versions up to and including Jenkins 2.441.
This vulnerability in #Jenkins is serious CVE-2024-23897
POCs have been published https://t.co/nGtbf8fehdhttps://t.co/pzY0NSL5bA
report by @SonarSource https://t.co/VNAUg2PDN8 pic.twitter.com/vbiWGmj47M
— Florian Roth (@cyb3rops) January 26, 2024
According to BleedingComputer, there is potential for attackers to decrypt stored secrets, delete items from Jenkins servers, and download Java heap dumps. It also suggested that there had already been several possible “genuine attempts at exploitation.”
In 2023, Jenkins was considered one of the best developer tools of the year due to its extensibility and adaptability. However, cybersecurity firm Armis has reported that cyber attacks more than doubled in 2023. They warn that numerous businesses worldwide continue to underestimate the escalating threat to cybersecurity.
Featured image: Canva / The Jenkins Project
The post Around 45k Jenkins servers still vulnerable to attacks due to critical flaw appeared first on ReadWrite.
Best Internet Providers in Akron, Ohio – CNET
No matter where you live in Akron, you’ll have access to at least one good high-speed internet provider.
No matter where you live in Akron, you’ll have access to at least one good high-speed internet provider.
Liverpool vs. Chelsea Livestream: How to Watch English Premier League Soccer From Anywhere – CNET
A key fixture at Anfield offers a preview of next month’s Carabao Cup final.
A key fixture at Anfield offers a preview of next month’s Carabao Cup final.
This Coupon Knocks 25% Off Food or Drink You Buy From QVC Today Only – CNET
Stock up on Super Bowl party food and beverages or just fill out your pantry with essentials while saving big.
Stock up on Super Bowl party food and beverages or just fill out your pantry with essentials while saving big.
Webex Now Available on Apple TV 4K for Video Calls
Webex today announced the launch of its new Webex app that’s designed for the Apple TV 4K. The app is designed to allow hybrid workers to join meetings from the biggest screen they have, which is often a television.
Users are able to scan the QR code on the sign-in screen and log in to the Webex app on Apple TV in order to join a meeting. Participating in a chat will require wirelessly connecting an iPhone or iPad to the Apple TV 4K to use the iOS device as a microphone and video camera.
Apple has previously used the iPhone/iPad to Apple TV connection for FaceTime, but the functionality is available to third-party apps as well.
Webex says that users can expect “crystal-clear audio and video,” with the app offering a preview of video and microphone status ahead of when a meeting is joined. Calendar integration is available, and the Siri Remote can be used for browsing through meetings and accessing in-meeting controls such as the camera on the connected iOS device.
Up to 25 simultaneous attendees can be shown on one screen with the Webex app for the Apple TV 4K, and the app can be downloaded from the App Store on the device. To use Webex on a TV, users must have a second-generation Apple TV 4K or later and an iOS device with either iOS 17 or iPadOS 17.This article, “Webex Now Available on Apple TV 4K for Video Calls” first appeared on MacRumors.comDiscuss this article in our forums
Webex today announced the launch of its new Webex app that’s designed for the Apple TV 4K. The app is designed to allow hybrid workers to join meetings from the biggest screen they have, which is often a television.
Users are able to scan the QR code on the sign-in screen and log in to the Webex app on Apple TV in order to join a meeting. Participating in a chat will require wirelessly connecting an iPhone or iPad to the Apple TV 4K to use the iOS device as a microphone and video camera.
Apple has previously used the iPhone/iPad to Apple TV connection for FaceTime, but the functionality is available to third-party apps as well.
Webex says that users can expect “crystal-clear audio and video,” with the app offering a preview of video and microphone status ahead of when a meeting is joined. Calendar integration is available, and the Siri Remote can be used for browsing through meetings and accessing in-meeting controls such as the camera on the connected iOS device.
Up to 25 simultaneous attendees can be shown on one screen with the Webex app for the Apple TV 4K, and the app can be downloaded from the App Store on the device. To use Webex on a TV, users must have a second-generation Apple TV 4K or later and an iOS device with either iOS 17 or iPadOS 17.
This article, “Webex Now Available on Apple TV 4K for Video Calls” first appeared on MacRumors.com
Discuss this article in our forums
‘Argylle’ review: Dumb in the wrong ways
Matthew Vaughn delivers a tedious espionage adventure that pulls its punches in “Argylle,” starring Bryce Dallas Howard.
With Kingsman: The Secret Service and Kick-Ass, English filmmaker Matthew Vaughn has twice shaken up stiff action subgenres with explosive energy and irreverence. These movies not only delivered gonzo violence, cascades of cursing, and bawdy sex jokes but also launched sequels. With the action-comedy Argylle, Vaughn seems to be at it again. But this time, he’s surrendered the hard-R rating that’s long served him well, instead presenting audiences with a PG-13 spy tale that regrettably pulls its punches.
It’s not just a matter of a high body count with virtually no blood (a trick Christopher Nolan’s Dark Knight trilogy pulled as well). It’s that without the R-rating, Vaughn is constrained to do something tamer. And for him, that means making a movie for women, where danger, romance, and hilarious hijinks — well, not so much collide as bump into each other awkwardly. See, Vaughn has no idea what women want, turning in a tedious espionage adventure that is too much in all the wrong ways.
Argylle is not Romancing the Stone.
Credit: Universal Pictures
The premise of Argylle has echoes of the 1984 comedy Romancing the Stone, in which Kathleen Turner stars as a romance novelist named Joan who gets swept up in an adventure that seems ripped from her book’s pages. (See also the Sandra Bullock romp The Lost City). Along the way, Joan fights and then falls in love with a rugged rogue named Jack (Michael Douglas). Argylle screenwriter Jason Fuchs contorts this setup slightly: Bryce Dallas Howard stars as Elly Conway, a heralded author of spy novels who finds herself caught up in a web of intrigue. Along the way, Elly becomes entangled with a real spy named Aiden (Sam Rockwell) who promises survival — and maybe romance.
However, the archetypes here have shifted. Elly is no sharp-tongued Kathleen Turner heroine, and Rockwell doesn’t have the swagger of ’80s Douglas. He’s less rugged and more world-weary. Playing a spy who is less Bond and more beach bum, Rockwell frequently looks like he’s sleepwalking or desperately bored, while Howard is often reduced to wide-eyed alarm and tiresome whining as an author plunged into a world she’s only experienced behind her laptop. The pair don’t have any sexual chemistry, so when the plot inevitably throws Elly and Aiden together into a sultry dance number, something crucial is missing.
Argylle lacks spark.
Credit: Universal Pictures
As demanded of spy movies, Vaughn’s latest will take audiences around the globe to exotic and gorgeous locations, wreaking carnage along the way. But in the wake of truly gonzo action movies like the Mission: Impossible and Fast and Furious franchises, Vaughn’s opening gambit of spy schtick — as seen in the trailer — feels a pale imitation, even if it is bolstered by big stars like Henry Cavill, Dua Lipa, and John Cena. You see, Argylle not only shows us Elly’s actual adventure with scruffy spy Aiden, but also the imagined adventures of her titular fictional spy: the debonair Agent Argylle, played by the Witcher star, wearing the worst haircut we’ve seen him in yet — a strangely square buzz cut that looks like he pissed off his barber.
It should be fun to watch the rumpled world of Rockwell’s real-world spy intercut with Elly’s glossier Argylle facing similar version of events as they unfold, with Cavill and Rockwell enacting the very same stunts in their different styles. But the bit gets old fast, in part because the Argylle character is woefully one-note. He’s all swagger, one-liners, and winks, whereas Rockwell’s Aiden seems bored and beleaguered, whether he’s taking down assassins or delivering a tutorial about how to crush a human skull. It’s a superficial (though solid) contrast, but its impact dulls in repetition.
As Elly gets into the action, there’s promise for a new turn. But frankly, what should be Argylle‘s most bonkers bits feel woefully underwhelming. Blame the lack of chemistry between its leads. Blame the fact that Vaughn rips off Birds of Prey, from a colorful smoke-bombed raid to cheeky dance-inspired action. Blame a soundtrack that favors ’70s disco and slow love songs to score fight scenes, seemingly aiming for Guardians of the Galaxy or Kingsmen but actually undercutting their stakes and energy. But most of all, blame that Vaughn has no concept of what women want in action heroines.
Argylle fails at Kingsman: BUT FOR GIRLS.
Credit: Universal Pictures
The premise of an everywoman getting swept into espionage, intrigue, and romance is a trusted formula for thrilling female audiences. However, Elly is less everywoman and more infantilized; she freaks out at any spy-level action, her only friend is her mom (an underused Catherine O’Hara), and her only loves are her writing and her cat, Alfie. Mostly confined to Elly’s backpack, the Scottish Fold fur baby is basically a Disney princess sidekick, cute and cuddly and — on rare occasions — relevant to the plot. Perhaps this is by design, with the PG-13 rating aiming to appeal to the many young women who contributed to making Barbie a blockbuster. But Barbie was more than a dazzling fantasy… and Argylle isn’t even dazzling.
The fashion fantasy that Barbie, The Lost City, and even the Tom Cruise movies offer women is woefully missed here. The fancy costumes in Argylle feel cartoonish more than glamorous. And in the real world, when Elly strives to live up to her fantasy on a mission, the result is an evening dress that fits like a dream but with a color that feels juvenile, along with an inexplicable haircut. She seems uncomfortable in it, as if she’s in costume rather than living her dream. So, when she begins pulling off big action moves, it’s missing the thrill of Harley Quinn cutting loose in cool clothes that are made to move — and kick ass — in.
The only time Argylle comes close to working is when it embraces the absurdities of spies dancing. Specifically, the “whirly bird” is superb. Here, one dancer hoists his partner into the air, her legs outstretched over his shoulders, her crotch at his face, and they spin, gracefully, defying physics and slyly simulating cunnilingus. This is as close as Argylle gets to a sex joke. And it’s also the closest it gets to realizing its own potential to be silly and sexy. Elsewhere, dance is bonded to violence, but it doesn’t stick the landing the way this running gag does.
Argylle is too much in the wrong ways.
Credit: Universal Pictures
It’s fine for an action movie to be stupid. The Fast and Furious franchise thrives on its increasing absurdity, and they are glorious movies. But for this to work, the filmmaker must embrace the ridiculous, declaring to the audience, “Yes, this is preposterous — but we are all having too much fun to care!”
Argylle is not fun enough to pull this off. Instead, it offers romance ruined by a lack of sex appeal, jokes that hit as hard as an infant might, and action doubly undermined by bewildering music choices and pulled punches — possibly because of the restraints of PG-13. (Notably, the killer doll slasher M3GAN managed to be jaw-droppingly violent with such a rating!) And worst of all, it is unforgivably long, belabored by plot twists.
Many of these turns and double-crosses are telegraphed so intensely that it feels wrong to call them a twist. Others involve barely established characters, and so carry all the emotional weight of a wiffle ball. Still others seem to exist to just drag out the third act for another action sequence. The actual runtime of this movie is two hours and 19 minutes, but midway through I began to wonder how long I’d been in the theater, waiting — pining — to laugh or feel a thrill. Had it been three hours? Four? A thousand!?
Vaughn’s other crime is in casting. On paper, this supporting lineup is stellar: In addition to the aforementioned Cavill, Cena, Lipa, and O’Hara, the cast includes Ariana DeBose, Bryan Cranston, Rob Delaney, and Samuel L. Jackson. But in execution, it’s a disaster. Fuchs’s script gives Cranston criminally cliched bad guy speeches, which the Breaking Bad star growls through with nowhere to go. O’Hara is wasted in a role without punchlines, as is Delaney. And the rest of the cast, from Lipa’s glitzy LaGrange to Cena’s tough guy Wyatt, are handed one-note characters who offer little more than the opportunity to cameo.
While there are some fun bits in Argylle, the whole is far less than the sum of its parts. So in the end, much like The Flash, this action movie feels less fun and more like a punishment.
Senate tells social media CEOs they have ‘blood on their hands’ for failing to protect children
The CEOs of Meta, Snap, Discord, X and TikTok testified at a high-stakes Senate Judiciary Committee hearing on child exploitation online. During the hearing, Mark Zuckerberg, Evan Spiegel, Jason Citron, Linda Yaccarino and Shou Chew spent hours being grilled by lawmakers about their records on child safety.
The hearing was the first time Spiegel, Citron and Yaccarino testified to Congress. Notably, all three were subpoenaed by the committee after refusing to appear voluntarily, according to lawmakers. Judiciary Committee Chair Senator Dick Durbin noted that Citron “only accepted services of his subpoena after US Marshals were sent to Discord’s headquarters at taxpayers’ expense.”
The hearing room was filled with parents of children who had been victims of online exploitation on social media. Many members of the audience silently held up photos of their children as the CEOs entered the room, and Durbin kicked off the hearing with a somber video featuring victims of child exploitation and their parents.
“Discord has been used to groom, abduct and abuse children,” Durbin said. “Meta’s Instagram helped connect and promote a network of pedophiles. Snapchat’s disappearing messages have been co-opted by criminals who financially extort young victims. TikTok has become a quote platform of choice for predators to access, engage and groom children for abuse. And the prevalence of CSAM on X has grown as the company has gutted its trust and safety workforce.”
During the hearing, many of the senators shared personal stories of parents whose children had died by suicide after being exploited online. “Mr. Zuckerberg, you and the companies before us — I know you don’t mean it to be so — but you have blood on your hands,” Senator Lindsey Graham said in his opening remarks. The audience applauded.
While years of similar hearings have so far failed to produce any new laws, there is growing bipartisan support in Congress for new safety regulations. As Tech Policy Press points out, there are currently more than half a dozen bills dealing with children’s online safety that have been proposed by senators. These include the Kids Online Safety Act (KOSA), which would require platforms to create more parental control and safety features and submit to independent audits, and COPPA 2.0, a revised version of the 1998 Children and Teens’ Online Privacy Protection Act, which would bar companies from collecting or monetizing children’s data without consent.
Senators have also proposed a number of bills to address child exploitation, including the EARN IT Act, currently in its third iteration since 2020, and the STOP CSAM Act. None of these have advanced to the Senate floor for a vote. Many of these bills have faced intense lobbying from the tech industry, though some companies in attendance said they are open to some aspects of the legislation.
Zuckerberg suggest a different approach, saying he supported age verification and parental control requirements at the app store level, which would effectively shift the burden to Apple and Google. Meta has come under particular pressure in recent months following a lawsuit from 41 states for harming teens’ mental health. Court documents from the suit allege that Meta turned a blind eye to children under 13 using its service, did little to stop adults from sexually harassing teens on Facebook and that Zuckerberg personally intervened to stop an effort to ban plastic surgery filters on Instagram.
Developing…
In the US, the National Suicide Prevention Lifeline is 1-800-273-8255 or you can simply dial 988. Crisis Text Line can be reached by texting HOME to 741741 (US), 686868 (Canada), or 85258 (UK). Wikipedia maintains a list of crisis lines for people outside of those countries.This article originally appeared on Engadget at https://www.engadget.com/senate-tells-social-media-ceos-they-have-blood-on-their-hands-for-failing-to-protect-children-170411884.html?src=rss
The CEOs of Meta, Snap, Discord, X and TikTok testified at a high-stakes Senate Judiciary Committee hearing on child exploitation online. During the hearing, Mark Zuckerberg, Evan Spiegel, Jason Citron, Linda Yaccarino and Shou Chew spent hours being grilled by lawmakers about their records on child safety.
The hearing was the first time Spiegel, Citron and Yaccarino testified to Congress. Notably, all three were subpoenaed by the committee after refusing to appear voluntarily, according to lawmakers. Judiciary Committee Chair Senator Dick Durbin noted that Citron “only accepted services of his subpoena after US Marshals were sent to Discord’s headquarters at taxpayers’ expense.”
The hearing room was filled with parents of children who had been victims of online exploitation on social media. Many members of the audience silently held up photos of their children as the CEOs entered the room, and Durbin kicked off the hearing with a somber video featuring victims of child exploitation and their parents.
“Discord has been used to groom, abduct and abuse children,” Durbin said. “Meta’s Instagram helped connect and promote a network of pedophiles. Snapchat’s disappearing messages have been co-opted by criminals who financially extort young victims. TikTok has become a quote platform of choice for predators to access, engage and groom children for abuse. And the prevalence of CSAM on X has grown as the company has gutted its trust and safety workforce.”
During the hearing, many of the senators shared personal stories of parents whose children had died by suicide after being exploited online. “Mr. Zuckerberg, you and the companies before us — I know you don’t mean it to be so — but you have blood on your hands,” Senator Lindsey Graham said in his opening remarks. The audience applauded.
While years of similar hearings have so far failed to produce any new laws, there is growing bipartisan support in Congress for new safety regulations. As Tech Policy Press points out, there are currently more than half a dozen bills dealing with children’s online safety that have been proposed by senators. These include the Kids Online Safety Act (KOSA), which would require platforms to create more parental control and safety features and submit to independent audits, and COPPA 2.0, a revised version of the 1998 Children and Teens’ Online Privacy Protection Act, which would bar companies from collecting or monetizing children’s data without consent.
Senators have also proposed a number of bills to address child exploitation, including the EARN IT Act, currently in its third iteration since 2020, and the STOP CSAM Act. None of these have advanced to the Senate floor for a vote. Many of these bills have faced intense lobbying from the tech industry, though some companies in attendance said they are open to some aspects of the legislation.
Zuckerberg suggest a different approach, saying he supported age verification and parental control requirements at the app store level, which would effectively shift the burden to Apple and Google. Meta has come under particular pressure in recent months following a lawsuit from 41 states for harming teens’ mental health. Court documents from the suit allege that Meta turned a blind eye to children under 13 using its service, did little to stop adults from sexually harassing teens on Facebook and that Zuckerberg personally intervened to stop an effort to ban plastic surgery filters on Instagram.
Developing…
In the US, the National Suicide Prevention Lifeline is 1-800-273-8255 or you can simply dial 988. Crisis Text Line can be reached by texting HOME to 741741 (US), 686868 (Canada), or 85258 (UK). Wikipedia maintains a list of crisis lines for people outside of those countries.
This article originally appeared on Engadget at https://www.engadget.com/senate-tells-social-media-ceos-they-have-blood-on-their-hands-for-failing-to-protect-children-170411884.html?src=rss
GitLab users warned of flaw that allows file overwrite — so update now
New GitLab flaw was found with a severity score of 9.9 – and users are urged to patch up without delay.
GitLab recently discovered a critical vulnerability in its Community Edition (CE) and Enterprise Edition (EE) instances, which could allow malicious actors to write arbitrary files while creating a workspace.
In a security bulletin, GitLab said the vulnerability is quite serious and that users should apply the patch with utmost urgency.
The vulnerability affects all versions from 16.0 prior to 16.5.8, 16.6 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1, the project said in the announcement.
More bugs to patch
“This is a critical severity issue,” GitLab said, adding that it has been assigned a severity score of 9.9. “It is now mitigated in the latest release and is assigned CVE-2024-0402.”
The company also said the patch was backported to 16.5.8 besides 16.6.6, 16.7.4, and 16.8.1. “GitLab 16.5.8 only includes a fix for this vulnerability and does not contain any of the other fixes or changes mentioned in this blog post,” the announcement concluded. GitLab.com and GitLab Dedicated environments are said to already be running the upgraded version.
In the same advisory, GitLab also said it addressed four medium-severity flaws that could result in a regular expression denial-of-service (ReDoS), HTML injection, and the leaking of users’ public email addresses via the tags RSS feed.
This is not the first time GitLab users were urged to immediately apply a patch and fix a critical flaw. In September last year, GitLab said it found a flaw in scan execution policies to run pipelines (a series of automated tasks) as another user.
This flaw was tracked as CVE-2023-4998 and carries a severity score of 9.6. It impacted a couple of versions of the software, namely GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.12 through 16.2.7, and versions 16.3 through 16.3.4.
Via The Hacker News
More from TechRadar Pro
GitLab users told to install emergency security fix immediatelyHere’s a list of the best firewalls around todayThese are the best endpoint security tools right now