‼ CVE-2021-44045 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation for the XFAT sectors count can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43035 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full access to the postgres user account.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43041 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43036 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43043 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43033 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43040 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43044 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43034 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43038 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger functions. This allowed privilege escalation from the wguest user to the postgres user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43039 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43037 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due to insecure default permissions. This allowed privilege escalation from an unprivileged user to SYSTEM.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43042 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploitable by a remote unauthenticated attacker.📖 Read
via "National Vulnerability Database".
🗓️ Crypto-exchange BitMart reports $150 million theft following hack 🗓️
📖 Read
via "The Daily Swig".
Security firm said attackers executed a ‘transfer-out, swap, and wash’📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Crypto-exchange BitMart reports $150 million theft following hack
Security firm said attackers executed a ‘transfer-out, swap, and wash’
‼ CVE-2021-43469 ‼
📖 Read
via "National Vulnerability Database".
VINGA WR-N300U 77.102.1.4853 is affected by a command execution vulnerability in the goahead component.📖 Read
via "National Vulnerability Database".
⚠ Mozilla patches critical “BigSig” cryptographic bug: Here’s how to track it down and fix it ⚠
📖 Read
via "Naked Security".
Mozilla's cryptographic code had a critical bug. Problem is that numerous apps are affected and may need patching individually.📖 Read
via "Naked Security".
Naked Security
Mozilla patches critical “BigSig” cryptographic bug: Here’s how to track it down and fix it
Mozilla’s cryptographic code had a critical bug. Problem is that numerous apps are affected and may need patching individually.
‼ CVE-2021-43471 ‼
📖 Read
via "National Vulnerability Database".
In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Why the C-Suite Doesn't Need Access to All Corporate Data 🕴
📖 Read
via "Dark Reading".
If zero trust is to work properly, then it must apply to everyone.📖 Read
via "Dark Reading".
Dark Reading
Why the C-Suite Doesn't Need Access to All Corporate Data
If zero trust is to work properly, then it must apply to everyone.
🦿 How to lock a Zoom meeting to keep out unwanted guests 🦿
📖 Read
via "Tech Republic".
One good way to prevent unwelcome participants or late arrivals from joining your Zoom meetings is to lock those meetings. Here's a look at how it's done.📖 Read
via "Tech Republic".
TechRepublic
How to lock a Zoom meeting to keep out unwanted guests | TechRepublic
One good way to prevent unwelcome participants or late arrivals from joining your Zoom meetings is to lock those meetings. Here's a look at how it's done.
🗓️ Critical vulnerabilities in open source forum software NodeBB could lead to RCE 🗓️
📖 Read
via "The Daily Swig".
Personal data, account access is at risk📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Critical vulnerabilities in open source forum software NodeBB could lead to RCE
Personal data, account access is at risk