‼ CVE-2021-36767 ‼
📖 Read
via "National Vulnerability Database".
In Digi RealPort through 4.8.488.0, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35977 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response messages. This could result in arbitrary code execution.📖 Read
via "National Vulnerability Database".
🔏 Friday Five 10/8 🔏
📖 Read
via "".
News on CISA's new system to attract cyber talent, an Apache zero day, and Microsoft on the lack of acceptance around MFA - catch up on the news of the week with the Friday Five!📖 Read
via "".
Digital Guardian
Friday Five 10/8
News on CISA's new system to attract cyber talent, an Apache zero day, and Microsoft on the lack of acceptance around MFA - catch up on the news of the week with the Friday Five!
🕴 'FontOnLake' Malware Family Targets Linux Systems 🕴
📖 Read
via "Dark Reading".
Researchers report that the location of its C2 server, the countries where samples were uploaded, may indicate targets include Southeast Asia.📖 Read
via "Dark Reading".
Dark Reading
'FontOnLake' Malware Family Targets Linux Systems
Researchers report that the location of its C2 server and the countries where samples were uploaded may indicate targets include Southeast Asia.
🕴 71% of Security Pros Find Patching to be Complex and Time Consuming, Ivanti Study Confirms 🕴
📖 Read
via "Dark Reading".
Challenges with lack of time and vulnerability and patching prioritization are putting organizations at increased risk of cyberattacks.📖 Read
via "Dark Reading".
Dark Reading
71% of Security Pros Find Patching to be Complex and Time Consuming, Ivanti Study Confirms
Challenges with lack of time and vulnerability and patching prioritization are putting organizations at increased risk of cyberattacks.
🦿 Motion Picture Academy employs cutting-edge tech to keep Oscar contenders secure 🦿
📖 Read
via "Tech Republic".
With video use on the rise across the board, new technologies are being deployed to prevent it from being pirated or showing up in places it shouldn't.📖 Read
via "Tech Republic".
TechRepublic
Motion Picture Academy employs cutting-edge tech to keep Oscar contenders secure
With video use on the rise across the board, new technologies are being deployed to prevent it from being pirated or showing up in places it shouldn't.
‼ CVE-2021-41564 ‼
📖 Read
via "National Vulnerability Database".
Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41802 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41975 ‼
📖 Read
via "National Vulnerability Database".
TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41920 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor_cible, sor_champs, and sor_ordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain access to the webTareas application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41916 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41825 ‼
📖 Read
via "National Vulnerability Database".
Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41919 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to exploit the platform by injecting code or malware and, under certain conditions, to execute code on remote user browsers.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41917 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section, due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and administrators. The affected endpoint is /clients/editclient.php, on the HTTP POST cn parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41566 ‼
📖 Read
via "National Vulnerability Database".
The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41976 ‼
📖 Read
via "National Vulnerability Database".
Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41563 ‼
📖 Read
via "National Vulnerability Database".
Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41568 ‼
📖 Read
via "National Vulnerability Database".
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32029 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20600 ‼
📖 Read
via "National Vulnerability Database".
Uncontrolled resource consumption in MELSEC iQ-R series C Controller Module R12CCPU-V all versions allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41565 ‼
📖 Read
via "National Vulnerability Database".
TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.📖 Read
via "National Vulnerability Database".