‼ CVE-2020-24672 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue affects: .📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21105 ‼
📖 Read
via "National Vulnerability Database".
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35526 ‼
📖 Read
via "National Vulnerability Database".
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 (Build Nr. 1.2.14002.257).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3054 ‼
📖 Read
via "National Vulnerability Database".
A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7; PAN-OS 10.1 versions earlier than PAN-OS 10.1.2. This issue does not affect Prisma Access.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-28732 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28372. Reason: This candidate is a duplicate of CVE-2021-28372. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2021-28372 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
🔏 Mitigations Available for Latest Office Zero Day 🔏
📖 Read
via "".
There's no patch yet but Microsoft has released a workaround to mitigate the latest zero day, a vulnerability announced this week in WIndows 10 and Windows Server.📖 Read
via "".
Digital Guardian
Mitigations Available for Latest Office Zero Day
There's no patch yet but Microsoft has released a workaround to mitigate the latest zero day, a vulnerability announced this week in WIndows 10 and Windows Server.
❌ Tooling Network Detection & Response for Ransomware ❌
📖 Read
via "Threat Post".
Justin Jett, director of audit and compliance at Plixer, discusses how to effectively use network flow data in the fight against ransomware.📖 Read
via "Threat Post".
Threat Post
Tooling Network Detection & Response for Ransomware
Justin Jett, director of audit and compliance at Plixer, discusses how to effectively use network flow data in the fight against ransomware.
🦿 Cybersecurity: Try machine learning to detect threats 🦿
📖 Read
via "Tech Republic".
Making predictions about data is the next frontier in terms of identifying risk in your infrastructure, expert says. But is it right for your organization?📖 Read
via "Tech Republic".
TechRepublic
Cybersecurity: Try machine learning to detect threats
Making predictions about data is the next frontier in terms of identifying risk in your infrastructure, expert says. But is it right for your organization?
🦿 Machine learning is a great tool for cybersecurity, but be cautious, expert says 🦿
📖 Read
via "Tech Republic".
Supervised and unsupervised machine learning are good ways to detect threats. But what's the difference?📖 Read
via "Tech Republic".
TechRepublic
Machine learning is a great tool for cybersecurity, but be cautious, expert says
Supervised and unsupervised machine learning are good ways to detect threats. But what's the difference?
🦿 Dark web prices drop for credit cards but soar for PayPal accounts 🦿
📖 Read
via "Tech Republic".
Selling prices for stolen PayPal accounts have shot up by 194%, according to research by Comparitech.📖 Read
via "Tech Republic".
TechRepublic
Dark web prices drop for credit cards but soar for PayPal accounts
Selling prices for stolen PayPal accounts have shot up by 194%, according to research by Comparitech.
‼ CVE-2021-32805 ‼
📖 Read
via "National Vulnerability Database".
Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability. To resolve this issue upgrade to Flask-AppBuilder 3.2.2 or above. If upgrading is infeasible users may filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting as a workaround.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40537 ‼
📖 Read
via "National Vulnerability Database".
Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38388 ‼
📖 Read
via "National Vulnerability Database".
Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31274 ‼
📖 Read
via "National Vulnerability Database".
In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36215 ‼
📖 Read
via "National Vulnerability Database".
LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36216 ‼
📖 Read
via "National Vulnerability Database".
LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection.📖 Read
via "National Vulnerability Database".
❌ What Ragnar Locker Got Wrong About Ransomware Negotiators – Podcast ❌
📖 Read
via "Threat Post".
There are a lot of "tells" that the ransomware group doesn't understand how negotiators work, despite threatening to dox data if victims call for help.📖 Read
via "Threat Post".
‼ CVE-2021-40797 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19137 ‼
📖 Read
via "National Vulnerability Database".
Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36440 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19138 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java".📖 Read
via "National Vulnerability Database".