❌

Normal view

There are new articles available, click to refresh the page.
Yesterday — 25 June 2024Main stream
Before yesterdayMain stream

SCOTUS rejects challenge to abortion pill for lack of standing

✇Ars Technica
By: Beth Mole
13 June 2024 at 11:38
Mifepristone (Mifeprex) and misoprostol, the two drugs used in a medication abortion, are seen at the Women's Reproductive Clinic, which provides legal medication abortion services, in Santa Teresa, New Mexico, on June 17, 2022.

Enlarge / Mifepristone (Mifeprex) and misoprostol, the two drugs used in a medication abortion, are seen at the Women's Reproductive Clinic, which provides legal medication abortion services, in Santa Teresa, New Mexico, on June 17, 2022. (credit: Getty | Robyn Beck)

The US Supreme Court on Thursday struck down a case that threatened to remove or at least restrict access to mifepristone, a pill approved by the Food and Drug Administration for medication abortions and used in miscarriage care. The drug has been used for decades, racking up a remarkably good safety record in that time. It is currently used in the majority of abortions in the US.

The high court found that the anti-abortion medical groups that legally challenged the FDA's decision to approve the drug in 2000 and then ease usage restrictions in 2016 and 2021 simply lacked standing to challenge any of those decisions. That is, the groups failed to demonstrate that they were harmed by the FDA's decision and therefore had no grounds to legally challenge the government agency's actions. The ruling tracks closely with comments and questions the justices raised during oral arguments in March.

"Plaintiffs are pro-life, oppose elective abortion, and have sincere legal, moral, ideological, and policy objections to mifepristone being prescribed and used by others," the Supreme Court noted in its opinion, which included the emphasis on "by others." The court summarized that the groups offered "complicated causation theories to connect FDA’s actions to the plaintiffs’ alleged injuries in fact," and the court found that "none of these theories suffices" to prove harm.

Read 3 remaining paragraphs | Comments

Dark Web Hacker ‘Tombstone’ Markets Google Subdomain Vulnerabilities on Cybercrime Forum

✇Cybersecurity News and Magazine
By: Ashish Khaitan
12 June 2024 at 08:06

XSS-DOM

A dark web hacker that goes by the name “Tombstone” has claimed and advertised multiple vulnerabilities affecting a subdomain affiliated with Google LLC. The hacker claimed these flaws on the Russian-language cybercrime forum Exploit and stressed the susceptibility of the domain to XSS-DOM and prototype pollution vulnerabilities. Screenshots shared by threat actor Tombstone showcased 'edu.google.com' as one of the allegedly impacted domains, raising concerns about potential exploits. Tombstone's post on Exploit lacked a specified price for the vulnerabilities, urging interested parties to initiate private communications for further details. The disclosed vulnerabilities pose significant risks to Google and its associated services, warranting immediate attention to mitigate potential cyber threats. "These vulnerabilities are in the software, not the source code Note that I only sell bugs with POC and full proof not exploits With a great price for long-term cooperation in other projects Exchange of Apple, FB, Meta, Microsoft banks", reads the threat actor post.

Dark Web Hacker Claims Prototype Pollution and XSS-DOM Vulnerability

[caption id="attachment_76830" align="alignnone" width="1108"]Prototype Pollution and XSS-DOM Vulnerability Source: Dark Web[/caption] The vulnerabilities advertised by Tombstone have direct implications for Google LLC, a prominent entity within the IT & ITES industry. Notably, domains such as google.com and edu.google.com have been identified as being at risk, primarily affecting users currently using the Google services.  The vulnerabilities disclosed by Tombstone encompass XSS-DOM and prototype pollution, both of which can serve as entry points for malicious cyber activities. XSS-DOM vulnerabilities, in particular, enable threat actors to inject client-side scripts into web pages viewed by other users, potentially leading to session hijacking, phishing attacks, malware distribution, and data theft. Prototype pollution vulnerabilities, however, involve manipulating a JavaScript object's prototype to achieve unintended behavior, often resulting in unauthorized data manipulation or code execution. The combination of these vulnerabilities within Google's subdomain highlights the critical need for robust cybersecurity measures to safeguard against potential cyberattacks.

Previous Incidents and Security Research

Prior to Tombstone's disclosure, security researcher Henry N. Caga had identified the XSS vulnerability within a Google subdomain, further emphasizing the susceptibility of Google's infrastructure to such exploits. Caga's research revealed the presence of a vulnerability within the URL associated with 'https://aihub.cloud.google.com,' prompting an in-depth investigation. Despite initial challenges in replicating the XSS pop-up, Caga's persistence ultimately led to the discovery of a double-encoded payload that triggered the vulnerability. Subsequent testing unveiled the widespread nature of the vulnerability across all URLs within the aihub.cloud.google.com domain, accentuating the severity of the issue. Following responsible disclosure protocols, Caga promptly reported the findings to Google's security team, accompanied by comprehensive documentation and proof of concept scripts. Google's swift response included an upgrade in the issue's priority and severity levels, acknowledging Caga's contributions with a reward of $4,133.70, along with a $1,000 bonus for the thoroughness of the report and proof of concept scripts. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
❌
❌