‼ CVE-2022-23132 ‼
📖 Read
via "National Vulnerability Database".
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23133 ‼
📖 Read
via "National Vulnerability Database".
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40327 ‼
📖 Read
via "National Vulnerability Database".
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23134 ‼
📖 Read
via "National Vulnerability Database".
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.📖 Read
via "National Vulnerability Database".
🦿 New study reveals phishing simulations might not be effective in training users 🦿
📖 Read
via "Tech Republic".
A new study at unprecedented scale revealed that embedded phishing training in simulations run by organizations doesn't work well. Yet crowd-sourcing phishing detection is.📖 Read
via "Tech Republic".
TechRepublic
New study reveals phishing simulations might not be effective in training users
A new study at unprecedented scale revealed that embedded phishing training in simulations run by organizations doesn't work well. Yet crowd-sourcing phishing detection is.
❌ US Military Ties Prolific MuddyWater Cyberespionage APT to Iran ❌
📖 Read
via "Threat Post".
US Cyber Command linked the group to Iranian intelligence and detailed its multi-pronged, increasingly sophisticated suite of malware tools.📖 Read
via "Threat Post".
Threat Post
US Military Ties Prolific MuddyWater Cyberespionage APT to Iran
US Cyber Command linked the group to Iranian intelligence and detailed its multi-pronged, increasingly sophisticated suite of malware tools.
🕴 How Cybercriminals Are Cashing in on the Culture of 'Yes' 🕴
📖 Read
via "Dark Reading".
The reward is always front of mind, while the potential harm of giving out a phone number doesn't immediately reveal itself.📖 Read
via "Dark Reading".
Dark Reading
How Cybercriminals Are Cashing in on the Culture of 'Yes'
The reward is always front of mind, while the potential harm of giving out a phone number doesn't immediately reveal itself.
🕴 New Vulnerabilities Highlight Risks of Trust in Public Cloud 🕴
📖 Read
via "Dark Reading".
Major cloud providers are vulnerable to exploitation because a single flaw can be turned into a global attack using trusted core services.📖 Read
via "Dark Reading".
Dark Reading
New Vulnerabilities Highlight Risks of Trust in Public Cloud
Major cloud providers are vulnerable to exploitation because a single flaw can be turned into a global attack using trusted core services.
‼ CVE-2022-22123 ‼
📖 Read
via "National Vulnerability Database".
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40567 ‼
📖 Read
via "National Vulnerability Database".
Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c when using mp4box, which causes a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40570 ‼
📖 Read
via "National Vulnerability Database".
The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40568 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22125 ‼
📖 Read
via "National Vulnerability Database".
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22124 ‼
📖 Read
via "National Vulnerability Database".
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39056 ‼
📖 Read
via "National Vulnerability Database".
The IBM i 7.1, 7.2, 7.3, and 7.4 Extended Dynamic Remote SQL server (EDRSQL) could allow a remote authenticated user to send a specially crafted request and cause a denial of service. IBM X-Force ID: 214537.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40813 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40571 ‼
📖 Read
via "National Vulnerability Database".
The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40569 ‼
📖 Read
via "National Vulnerability Database".
The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22122 ‼
📖 Read
via "National Vulnerability Database".
In Mattermost Focalboard, versions prior to v0.7.5, v0.8.4, v0.9.5, v0.10.1 and v0.11.0-rc1; as used respectively in Mattermost, versions prior to v5.37.6, v5.39.3, v6.0.4, v6.1.1 and v6.2.0, are vulnerable to Insufficient Session Expiration. When a user initiates a logout, their session is not invalidated properly. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, to completely take over a victim account.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21678 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.📖 Read
via "National Vulnerability Database".
❌ North Korean APTs Stole ~$400M in Crypto in 2021 ❌
📖 Read
via "Threat Post".
Meanwhile, EtherumMax got sued over an alleged pump-and-dump scam after using celebs like Floyd Mayweather Jr. & Kim Kardashian to promote EMAX Tokens.📖 Read
via "Threat Post".
Threat Post
North Korean APTs Stole ~$400M in Crypto in 2021
Meanwhile, EtherumMax got sued over an alleged pump-and-dump scam after using celebs like Floyd Mayweather Jr. & Kim Kardashian to promote EMAX Tokens.