🦿 Study finds 31% of third-party vendors could cause significant damage to organizations if breached 🦿
📖 Read
via "Tech Republic".
Risk professionals relying on questionnaire-based assessments could be in for a rude awakening, according to Mastercard's RiskRecon and the Cyentia Institute.📖 Read
via "Tech Republic".
TechRepublic
Study finds 31% of third-party vendors could cause significant damage to organizations if breached
Risk professionals relying on questionnaire-based assessments could be in for a rude awakening, according to Mastercard's RiskRecon and the Cyentia Institute.
❌ VMware Fixes Critical Flaw in ESXi Hypervisor ❌
📖 Read
via "Threat Post".
The critical and important-severity flaws were found by a team at the China-based Tiunfu Cup hacking challenge.📖 Read
via "Threat Post".
Threat Post
VMware Fixes Critical Flaw in ESXi Hypervisor
The critical and important-severity flaws were found by a team at the China-based Tiunfu Cup hacking challenge.
❌ Good Heavens! 10M Impacted in Pray.com Data Exposure ❌
📖 Read
via "Threat Post".
The information exposed in a public cloud bucket included PII, church-donation information, photos and users' contact lists.📖 Read
via "Threat Post".
Threat Post
Good Heavens! 10M Impacted in Pray.com Data Exposure
The information exposed in a public cloud bucket included PII, church-donation information, photos and users' contact lists.
❌ Google Services Weaponized to Bypass Security in Phishing, BEC Campaigns ❌
📖 Read
via "Threat Post".
Attackers exploiting an array of Google Services, including Forms, Firebase, Docs and more to boost phishing and BEC campaigns.📖 Read
via "Threat Post".
Threat Post
Google Services Weaponized to Bypass Security in Phishing, BEC Campaigns
Attackers exploiting an array of Google Services, including Forms, Firebase, Docs and more to boost phishing and BEC campaigns.
‼ CVE-2020-4004 ‼
📖 Read
via "National Vulnerability Database".
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28845 ‼
📖 Read
via "National Vulnerability Database".
A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20739 ‼
📖 Read
via "National Vulnerability Database".
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19878 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to historical data from AprolSqlServer by bypassing authentication, a different vulnerability than CVE-2019-16358.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28921 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This could lead to arbitrary Ring-0 code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19873 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19874 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands on the web server, a different vulnerability than CVE-2019-16364.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27746 ‼
📖 Read
via "National Vulnerability Database".
Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15685 ‼
📖 Read
via "National Vulnerability Database".
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27745 ‼
📖 Read
via "National Vulnerability Database".
Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15684 ‼
📖 Read
via "National Vulnerability Database".
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7780 ‼
📖 Read
via "National Vulnerability Database".
This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15680 ‼
📖 Read
via "National Vulnerability Database".
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15686 ‼
📖 Read
via "National Vulnerability Database".
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19877 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory via Directory Traversal attacks against AprolSqlServer, a different vulnerability than CVE-2019-16357.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19875 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15681 ‼
📖 Read
via "National Vulnerability Database".
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.📖 Read
via "National Vulnerability Database".