‼ CVE-2021-44231 ‼
📖 Read
via "National Vulnerability Database".
Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39315 ‼
📖 Read
via "National Vulnerability Database".
The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2021-44549 ‼
📖 Read
via "National Vulnerability Database".
Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39313 ‼
📖 Read
via "National Vulnerability Database".
The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42069 ‼
📖 Read
via "National Vulnerability Database".
When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application📖 Read
via "National Vulnerability Database".
❌ How to Buy Precious Patching Time as Log4j Exploits Fly ❌
📖 Read
via "Threat Post".
Podcast: Cybereason shares details about its vaccine: a fast shot in the arm released within hours of the Apache Log4j zero-day horror show being disclosed.📖 Read
via "Threat Post".
❌ What the Log4Shell Bug Means for SMBs: Experts Weigh In ❌
📖 Read
via "Threat Post".
An exclusive roundtable of security researchers discuss the specific implications of CVE-2021-44228 for smaller businesses, including what's vulnerable, what an attack looks like and to how to remediate.📖 Read
via "Threat Post".
Threat Post
What the Log4Shell Bug Means for SMBs: Experts Weigh In
An exclusive roundtable of security researchers discuss the specific implications of CVE-2021-44228 for smaller businesses, including what's vulnerable, what an attack looks like and to how to remediate.
🦿 The 10 worst password snafus of 2021 🦿
📖 Read
via "Tech Republic".
Dashlane's sixth annual list of the year's worst password offenders reveals the biggest password security mishaps for 2021.📖 Read
via "Tech Republic".
TechRepublic
The 10 worst password snafus of 2021
Dashlane's sixth annual list of the year's worst password offenders reveals the biggest password security mishaps for 2021.
🦿 E-commerce: How to build customer trust without sacrificing security 🦿
📖 Read
via "Tech Republic".
Companies must attempt to divert cybercriminals without inconveniencing or possibly exposing customers and their data. One expert explains how it's possible.📖 Read
via "Tech Republic".
TechRepublic
E-commerce: How to build customer trust without sacrificing security
Companies must attempt to divert cybercriminals without inconveniencing or possibly exposing customers and their data. One expert explains how it's possible.
🕴 Source Code Leaks: The Real Problem Nobody Is Paying Attention To 🕴
📖 Read
via "Dark Reading".
Source code is a corporate asset like any other, which makes it an attractive target for hackers.📖 Read
via "Dark Reading".
Dark Reading
Source Code Leaks: The Real Problem Nobody Is Paying Attention To
Source code is a corporate asset like any other, which makes it an attractive target for hackers.
‼ CVE-2021-44041 ‼
📖 Read
via "National Vulnerability Database".
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38950 ‼
📖 Read
via "National Vulnerability Database".
IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43388 ‼
📖 Read
via "National Vulnerability Database".
Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40882 ‼
📖 Read
via "National Vulnerability Database".
A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44042 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44043 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43807 ‼
📖 Read
via "National Vulnerability Database".
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. The vulnerability allows attackers to craft links or forms which may change the server state. This issue is fixed in Opencast 9.10 and 10.0. You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.📖 Read
via "National Vulnerability Database".
🦿 Get a year of PlayStation Plus, a lifetime of learning and maximum VPN protection for $64 🦿
📖 Read
via "Tech Republic".
You can send your career soaring by learning highly paid skills online from over 1,000 courses without worrying about security, and enjoy a bit of extra gaming during your breaks.📖 Read
via "Tech Republic".
TechRepublic
Get a year of PlayStation Plus, a lifetime of learning and maximum VPN protection for $64
You can send your career soaring by learning highly paid skills online from over 1,000 courses without worrying about security, and enjoy a bit of extra gaming during your breaks.
♟️ Inside Ireland’s Public Healthcare Ransomware Scare ♟️
📖 Read
via "Krebs on Security".
The accounting firm PricewatersCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland's public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousand of outdated Windows 7 systems, and that the health system's IT administrators failed to respond to multiple warning signs that a massive attack was imminent.📖 Read
via "Krebs on Security".
Krebsonsecurity
Inside Ireland’s Public Healthcare Ransomware Scare
The accounting firm PricewatersCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland's public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial…
❌ 400 Banks’ Customers Targeted with Anubis Trojan ❌
📖 Read
via "Threat Post".
The new campaign masqueraded as an Orange Telecom account management app to deliver the latest iteration of Anubis banking malware.📖 Read
via "Threat Post".
Threat Post
400 Banks’ Customers Targeted with Anubis Trojan
The new campaign masqueraded as an Orange Telecom account management app to deliver the latest iteration of Anubis banking malware.
🦿 New Microsoft Exchange credential stealing malware could be worse than phishing 🦿
📖 Read
via "Tech Republic".
While looking for additional Exchange vulnerabilities in the wake of this year's zero-days, Kaspersky found an IIS add-on that harvests credentials from OWA whenever, and wherever, someone logs in.📖 Read
via "Tech Republic".