‼ CVE-2021-24849 ‼
📖 Read
via "National Vulnerability Database".
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections📖 Read
via "National Vulnerability Database".
🕴 How is Zero Trust Evolving to be More Continuous in Verifying Trust? 🕴
📖 Read
via "Dark Reading".
For zero trust to be successful, organizations need to be able to check user identity, device posture, and overall behavior without adding friction to the experience.📖 Read
via "Dark Reading".
Dark Reading
How Is Zero Trust Evolving to Be More Continuous in Verifying Trust?
For zero trust to be successful, organizations need to be able to check user identity, device posture, and overall behavior without adding friction to the experience.
‼ CVE-2021-45255 ‼
📖 Read
via "National Vulnerability Database".
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45253 ‼
📖 Read
via "National Vulnerability Database".
The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45252 ‼
📖 Read
via "National Vulnerability Database".
Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability.📖 Read
via "National Vulnerability Database".
🗓️ Ubisoft confirms Just Dance video game data breach 🗓️
📖 Read
via "The Daily Swig".
Developer said no accounts had been improperly accessed📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Ubisoft confirms Just Dance video game data breach
Developer said no accounts had been improperly accessed
🦿 F-Secure uses flaw in at-home COVID-19 test to fake results 🦿
📖 Read
via "Tech Republic".
Security researchers used a Bluetooth vulnerability to change negative results to positive.📖 Read
via "Tech Republic".
TechRepublic
F-Secure uses flaw in at-home COVID-19 test to fake results
Security researchers used a Bluetooth vulnerability to change negative results to positive.
❌ FBI: Another Zoho ManageEngine Zero-Day Under Active Attack ❌
📖 Read
via "Threat Post".
APT attackers are using a security vulnerability in ManageEngine Desktop Central to take over servers, deliver malware and establish network persistence.📖 Read
via "Threat Post".
Threat Post
FBI: Another Zoho ManageEngine Zero-Day Under Active Attack
APT attackers are using a security vulnerability in ManageEngine Desktop Central to take over servers, deliver malware and establish network persistence.
‼ CVE-2021-4139 ‼
📖 Read
via "National Vulnerability Database".
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')📖 Read
via "National Vulnerability Database".
🕴 The Future of Ransomware 🕴
📖 Read
via "Dark Reading".
Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.📖 Read
via "Dark Reading".
Dark Reading
The Future of Ransomware
Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.
🗓️ Browser security: Google fixes Chrome Site Isolation bypass bug 🗓️
📖 Read
via "The Daily Swig".
Vulnerability in Chrome’s service worker feature created chink in browser’s armor📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Browser security: Google fixes Chrome Site Isolation bypass bug
Vulnerability in Chrome’s service worker feature created chink in browser’s armor
🕴 A Year in Microsoft Bugs: The Most Critical, Overlooked & Hard to Patch 🕴
📖 Read
via "Dark Reading".
Severe flaws in Microsoft Exchange and Windows Print Spooler stood out amid a wide range of vulnerabilities security teams were forced to prioritize in 2021.📖 Read
via "Dark Reading".
Dark Reading
A Year in Microsoft Bugs: The Most Critical, Overlooked & Hard to Patch
Severe flaws in Microsoft Exchange and Windows Print Spooler stood out amid a wide range of vulnerabilities security teams were forced to prioritize in 2021.
🗓️ Survey scams rekindled using advertising industry tricks to deliver tailor-made assaults 🗓️
📖 Read
via "The Daily Swig".
More bad men than Mad Men📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Survey scams rekindled using advertising industry tricks to deliver tailor-made assaults
More bad men than Mad Men
❌ Two Active Directory Bugs Lead to Easy Windows Domain Takeover ❌
📖 Read
via "Threat Post".
Microsoft is urging customers to patch two Active Directory domain controller bugs after a PoC tool was publicly released on Dec. 12.📖 Read
via "Threat Post".
Threat Post
Two Active Directory Bugs Lead to Easy Windows Domain Takeover
Microsoft is urging customers to patch two Active Directory domain controller bugs after a PoC tool was publicly released on Dec. 12.
‼ CVE-2012-20001 ‼
📖 Read
via "National Vulnerability Database".
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45090 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Endpoint Security before 2.1.2 allows remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45089 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45091 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.📖 Read
via "National Vulnerability Database".
⚠ Apache’s other product: Critical bugs in ‘httpd’ web server, patch now! ⚠
📖 Read
via "Naked Security".
The Apache web server just got an update - this one is nothing to do with Log4j!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Log4Shell: The Movie… a short, safe visual tour for work and home ⚠
📖 Read
via "Naked Security".
Be happy that your sysadmins are taking one (three, actually!) for the team right now... here's why!📖 Read
via "Naked Security".
Naked Security
Log4Shell: The Movie… a short, safe visual tour for work and home
Be happy that your sysadmins are taking one (three, actually!) for the team right now… here’s why!
‼ CVE-2021-43587 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may potentially exploit this vulnerability to gain access to secrets and elevate to gain higher privileges.📖 Read
via "National Vulnerability Database".