‼ CVE-2022-21669 ‼
📖 Read
via "National Vulnerability Database".
PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28102 ‼
📖 Read
via "National Vulnerability Database".
cscms v4.1 allows for SQL injection via the "js_del" function.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28103 ‼
📖 Read
via "National Vulnerability Database".
cscms v4.1 allows for SQL injection via the "page_del" function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0170 ‼
📖 Read
via "National Vulnerability Database".
peertube is vulnerable to Improper Access Control📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21671 ‼
📖 Read
via "National Vulnerability Database".
@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl (not of the account). This was patched in version 7.3.1 by updating the address of the fallback WebSocket polling proxy to the new one. As a workaround, a user may specify the new address for the polling host (`gp-v2.replit.com`) in the `ConnectArgs`. More information about this workaround is available in the GitHub Security Advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43566 ‼
📖 Read
via "National Vulnerability Database".
All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.📖 Read
via "National Vulnerability Database".
🕴 Businesses Suffered 50% More Cyberattack Attempts per Week in 2021 🕴
📖 Read
via "Dark Reading".
The rise — partly due to Log4j — helped boost cyberattack attempts to an all-time high in Q4 2021, new data shows.📖 Read
via "Dark Reading".
Dark Reading
Businesses Suffered 50% More Cyberattack Attempts per Week in 2021
The rise — partly due to Log4j — helped boost cyberattack attempts to an all-time high in Q4 2021, new data shows.
❌ FIN7 Mailing Malicious USB Sticks to Drop Ransomware ❌
📖 Read
via "Threat Post".
The FBI warned that attackers are impersonating Health & Human Services and/or Amazon to mail BadUSB-poisoned USB devices to targets in transportation, insurance & defense.📖 Read
via "Threat Post".
Threat Post
FIN7 Mails Malicious USB Sticks to Drop Ransomware
The FBI warned that attackers are impersonating Health & Human Services and/or Amazon to mail BadUSB-poisoned USB devices to targets in transportation, insurance & defense.
⚠ Home routers with NetUSB support could have critical kernel hole ⚠
📖 Read
via "Naked Security".
Got a router that supports USB access across the network? You might need a kernel update...📖 Read
via "Naked Security".
Naked Security
Home routers with NetUSB support could have critical kernel hole
Got a router that supports USB access across the network? You might need a kernel update…
🕴 Remotely Exploitable NetUSB Flaw Puts Millions of Devices at Risk 🕴
📖 Read
via "Dark Reading".
A vulnerability in a third-party component used by many networking firms puts consumer and small business routers at risk for remote exploitation.📖 Read
via "Dark Reading".
Dark Reading
Remotely Exploitable NetUSB Flaw Puts Millions of Devices at Risk
A vulnerability in a third-party component used by many networking firms puts consumer and small business routers at risk for remote exploitation.
🕴 Why the Insider Threat Will Motivate Cyber and Physical Teams to Collaborate More Than Ever in 2022 🕴
📖 Read
via "Dark Reading".
It's hard to have a crystal ball in the world of security, but if one were to make a safe prediction, it's this: Organizations will need to further integrate their cybersecurity and physical security functions throughout 2022 and beyond. So argues former chief psychologist for the US Secret Service, Dr. Marisa Randazzo, who now heads up Ontic's Center of Excellence.📖 Read
via "Dark Reading".
Dark Reading
Why the Insider Threat Will Motivate Cyber and Physical Teams to Collaborate More Than Ever in 2022
It's hard to have a crystal ball in the world of security, but if one were to make a safe prediction, it's this: Organizations will need to further integrate their cybersecurity and physical security functions throughout 2022 and beyond. So argues former…
‼ CVE-2022-0129 ‼
📖 Read
via "National Vulnerability Database".
Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaining elevation of privileges to system user. This was achieved through placing the malicious DLL in the same directory that the process was run from.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0173 ‼
📖 Read
via "National Vulnerability Database".
radare2 is vulnerable to Out-of-bounds Read📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38991 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.0, 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could lead to code execution. IBM X-Force ID: 212953.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29701 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 as well as IBM Rational Team Concert 6.0.6 and 6.0.6.1 could allow an authneticated attacker to obtain sensitive information from build definitions that could aid in further attacks against the system. IBM X-Force ID: 200657.📖 Read
via "National Vulnerability Database".
🕴 FBI, NSA & CISA Issue Advisory on Russian Cyber Threat to US Critical Infrastructure 🕴
📖 Read
via "Dark Reading".
Advisory explains how to detect, respond to, and mitigate cyberattacks from Russian state-sponsored hacking groups.📖 Read
via "Dark Reading".
Dark Reading
FBI, NSA & CISA Issue Advisory on Russian Cyber Threat to US Critical Infrastructure
Advisory explains how to detect, respond to, and mitigate cyberattacks from Russian state-sponsored hacking groups.
🕴 Details Released on SonicWall Flaws in SMA Devices 🕴
📖 Read
via "Dark Reading".
The most serious of the five vulnerabilities disclosed today can lead to unauthenticated remote code execution on affected devices.📖 Read
via "Dark Reading".
Dark Reading
Details Released on SonicWall Flaws in SMA-100 Devices
The most serious of the five vulnerabilities disclosed today can lead to unauthenticated remote code execution on affected devices.
❌ WordPress Bugs Exploded in 2021, Most Exploitable ❌
📖 Read
via "Threat Post".
Record-number WordPress plugin vulnerabilities are wicked exploitable even with low CVSS scores, leaving security teams blind to their risk.📖 Read
via "Threat Post".
Threat Post
WordPress Bugs Exploded in 2021, Most Exploitable
Record-number WordPress plugin vulnerabilities are wicked exploitable even with low CVSS scores, leaving security teams blind to their risk.
❌ MacOS Bug Could Let Creeps Snoop On You ❌
📖 Read
via "Threat Post".
The flaw could allow attackers to bypass Privacy preferences, giving apps with no right to access files, microphones or cameras the ability to record you or grab screenshots.📖 Read
via "Threat Post".
Threat Post
MacOS Bug Could Let Creeps Snoop On You
The flaw could allow attackers to bypass Privacy preferences, giving apps with no right to access files, microphones or cameras the ability to record you or grab screenshots.
‼ CVE-2021-43973 ‼
📖 Read
via "National Vulnerability Database".
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43974 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.📖 Read
via "National Vulnerability Database".