‼ CVE-2021-45255 ‼
📖 Read
via "National Vulnerability Database".
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45253 ‼
📖 Read
via "National Vulnerability Database".
The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45252 ‼
📖 Read
via "National Vulnerability Database".
Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability.📖 Read
via "National Vulnerability Database".
🗓️ Ubisoft confirms Just Dance video game data breach 🗓️
📖 Read
via "The Daily Swig".
Developer said no accounts had been improperly accessed📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Ubisoft confirms Just Dance video game data breach
Developer said no accounts had been improperly accessed
🦿 F-Secure uses flaw in at-home COVID-19 test to fake results 🦿
📖 Read
via "Tech Republic".
Security researchers used a Bluetooth vulnerability to change negative results to positive.📖 Read
via "Tech Republic".
TechRepublic
F-Secure uses flaw in at-home COVID-19 test to fake results
Security researchers used a Bluetooth vulnerability to change negative results to positive.
❌ FBI: Another Zoho ManageEngine Zero-Day Under Active Attack ❌
📖 Read
via "Threat Post".
APT attackers are using a security vulnerability in ManageEngine Desktop Central to take over servers, deliver malware and establish network persistence.📖 Read
via "Threat Post".
Threat Post
FBI: Another Zoho ManageEngine Zero-Day Under Active Attack
APT attackers are using a security vulnerability in ManageEngine Desktop Central to take over servers, deliver malware and establish network persistence.
‼ CVE-2021-4139 ‼
📖 Read
via "National Vulnerability Database".
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')📖 Read
via "National Vulnerability Database".
🕴 The Future of Ransomware 🕴
📖 Read
via "Dark Reading".
Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.📖 Read
via "Dark Reading".
Dark Reading
The Future of Ransomware
Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.
🗓️ Browser security: Google fixes Chrome Site Isolation bypass bug 🗓️
📖 Read
via "The Daily Swig".
Vulnerability in Chrome’s service worker feature created chink in browser’s armor📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Browser security: Google fixes Chrome Site Isolation bypass bug
Vulnerability in Chrome’s service worker feature created chink in browser’s armor
🕴 A Year in Microsoft Bugs: The Most Critical, Overlooked & Hard to Patch 🕴
📖 Read
via "Dark Reading".
Severe flaws in Microsoft Exchange and Windows Print Spooler stood out amid a wide range of vulnerabilities security teams were forced to prioritize in 2021.📖 Read
via "Dark Reading".
Dark Reading
A Year in Microsoft Bugs: The Most Critical, Overlooked & Hard to Patch
Severe flaws in Microsoft Exchange and Windows Print Spooler stood out amid a wide range of vulnerabilities security teams were forced to prioritize in 2021.
🗓️ Survey scams rekindled using advertising industry tricks to deliver tailor-made assaults 🗓️
📖 Read
via "The Daily Swig".
More bad men than Mad Men📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Survey scams rekindled using advertising industry tricks to deliver tailor-made assaults
More bad men than Mad Men
❌ Two Active Directory Bugs Lead to Easy Windows Domain Takeover ❌
📖 Read
via "Threat Post".
Microsoft is urging customers to patch two Active Directory domain controller bugs after a PoC tool was publicly released on Dec. 12.📖 Read
via "Threat Post".
Threat Post
Two Active Directory Bugs Lead to Easy Windows Domain Takeover
Microsoft is urging customers to patch two Active Directory domain controller bugs after a PoC tool was publicly released on Dec. 12.
‼ CVE-2012-20001 ‼
📖 Read
via "National Vulnerability Database".
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45090 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Endpoint Security before 2.1.2 allows remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45089 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45091 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.📖 Read
via "National Vulnerability Database".
⚠ Apache’s other product: Critical bugs in ‘httpd’ web server, patch now! ⚠
📖 Read
via "Naked Security".
The Apache web server just got an update - this one is nothing to do with Log4j!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Log4Shell: The Movie… a short, safe visual tour for work and home ⚠
📖 Read
via "Naked Security".
Be happy that your sysadmins are taking one (three, actually!) for the team right now... here's why!📖 Read
via "Naked Security".
Naked Security
Log4Shell: The Movie… a short, safe visual tour for work and home
Be happy that your sysadmins are taking one (three, actually!) for the team right now… here’s why!
‼ CVE-2021-43587 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may potentially exploit this vulnerability to gain access to secrets and elevate to gain higher privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36350 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A remote unauthenticated attacker may potentially exploit this vulnerability and bypass one of the factors of authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36318 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage.📖 Read
via "National Vulnerability Database".