βΌ CVE-2022-23222 βΌ
π Read
via "National Vulnerability Database".
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.π Read
via "National Vulnerability Database".
βΌ CVE-2022-23219 βΌ
π Read
via "National Vulnerability Database".
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.π Read
via "National Vulnerability Database".
βΌ CVE-2022-20698 βΌ
π Read
via "National Vulnerability Database".
A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.π Read
via "National Vulnerability Database".
βΌ CVE-2021-33962 βΌ
π Read
via "National Vulnerability Database".
China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_device component.π Read
via "National Vulnerability Database".
β S3 Ep65: Supply chain conniption, NetUSB hole, Honda flashback, FTC muscle [Podcast + Transcript] β
π Read
via "Naked Security".
Latest episode -listen to it or read it now!π Read
via "Naked Security".
Naked Security
S3 Ep65: Supply chain conniption, NetUSB hole, Honda flashback, FTC muscle [Podcast + Transcript]
Latest episode -listen to it or read it now!
β Three Plugins with Same Bug Put 84K WordPress Sites at Risk β
π Read
via "Threat Post".
Researchers discovered vulnerabilities that can allow for full site takeover in login and e-commerce add-ons for the popular website-building platform.π Read
via "Threat Post".
Threat Post
Three Plugins with Same Bug Put 84K WordPress Sites at Risk
Researchers discovered vulnerabilities that can allow for full site takeover in login and e-commerce add-ons for the popular website-building platform.
β REvil ransomware crew allegedly busted in Russia, says FSB β
π Read
via "Naked Security".
The Russian Federal Security Bureau has just published a report about the investigation and arrest of the infamous "REvil" ransomware crew.π Read
via "Naked Security".
Naked Security
REvil ransomware crew allegedly busted in Russia, says FSB
The Russian Federal Security Bureau has just published a report about the investigation and arrest of the infamous βREvilβ ransomware crew.
β Russian Security Takes Down REvil Ransomware Gang β
π Read
via "Threat Post".
The country's FSB said that it raided gang hideouts; seized currency, cars and personnel; and neutralized REvil's infrastructure.π Read
via "Threat Post".
Threat Post
Russian Security Takes Down REvil Ransomware Gang
The country's FSB said that it raided gang hideouts; seized currency, cars and personnel; and neutralized REvil's infrastructure.
ποΈ Apache Software Foundation warns its patching efforts are being undercut by use of end-of-life software ποΈ
π Read
via "The Daily Swig".
Non-profit shares metrics in its latest annual security review of 350-plus projectsπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Apache Software Foundation warns its patching efforts are being undercut by use of end-of-life software
Non-profit shares metrics in its latest annual security review of 350-plus projects
βΌ CVE-2022-0213 βΌ
π Read
via "National Vulnerability Database".
vim is vulnerable to Heap-based Buffer Overflowπ Read
via "National Vulnerability Database".
π΄ What's Next for Patch Management: Automation π΄
π Read
via "Dark Reading".
The next five years will bring the widespread use of hyperautomation in patch management. Part 3 of 3.π Read
via "Dark Reading".
Dark Reading
What's Next for Patch Management: Automation
The next five years will bring the widespread use of hyperautomation in patch management. Part 3 of 3.
β βBe Afraid:β Massive Cyberattack Downs Ukrainian Govβt Sites β
π Read
via "Threat Post".
As Moscow moves troops and threatens military action, about 70 Ukrainian government sites were hit. βBe afraidβ was scrawled on the Foreign Ministry site.π Read
via "Threat Post".
Threat Post
βBe Afraid:β Massive Cyberattack Downs Ukrainian Govβt Sites
As Moscow moves troops and threatens military action, about 70 Ukrainian government sites were hit. βBe afraidβ was scrawled on the Foreign Ministry site.
ποΈ Researcher discloses alleged zero-day vulnerabilities in NUUO NVRmini2 recording device ποΈ
π Read
via "The Daily Swig".
Exploit code has also been released for flaws that supposedly date back to 2016π Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Researcher discloses alleged zero-day vulnerabilities in NUUO NVRmini2 recording device
Exploit code has also been released for flaws that supposedly date back to 2016
β Real Big Phish: Mobile Phishing & Managing User Fallibility β
π Read
via "Threat Post".
Phishing is more successful than ever. Daniel Spicer, CSO of Ivanti, discusses emerging trends in phishing, and using zero-trust security to patch the human vulnerabilities underpinning the spike.π Read
via "Threat Post".
Threat Post
Real Big Phish: Mobile Phishing & Managing User Fallibility
Phishing is more successful than ever. Daniel Spicer, CSO of Ivanti, discusses emerging trends in phishing, and using zero-trust security to patch the human vulnerabilities underpinning the spike.
β Critical Cisco Contact Center Bug Threatens Customer-Service Havoc β
π Read
via "Threat Post".
Attackers could access and modify agent resources, telephone queues and other customer-service systems β and access personal information on companiesβ customers.π Read
via "Threat Post".
Threat Post
Critical Cisco Contact Center Bug Threatens Customer-Service Havoc
Attackers could access and modify agent resources, telephone queues and other customer-service systems β and access personal information on companiesβ customers.
βΌ CVE-2021-32650 βΌ
π Read
via "National Vulnerability Database".
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.π Read
via "National Vulnerability Database".
βΌ CVE-2021-32649 βΌ
π Read
via "National Vulnerability Database".
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.π Read
via "National Vulnerability Database".
π¦Ώ 7 obstacles that organizations face migrating legacy data to the cloud π¦Ώ
π Read
via "Tech Republic".
Some of the major obstacles center on concerns about compliance, fears about security and infrastructure and uncertainty about budget requirements, says Archive360.π Read
via "Tech Republic".
TechRepublic
7 obstacles that organizations face migrating legacy data to the cloud
Some of the major obstacles center on concerns about compliance, fears about security and infrastructure and uncertainty about budget requirements, says Archive360.
β Top Illicit Carding Marketplace UniCC Abruptly Shuts Down β
π Read
via "Threat Post".
UniCC controlled 30 percent of the stolen payment-card data market; leaving analysts eyeing whatβs next.π Read
via "Threat Post".
Threat Post
Top Illicit Carding Marketplace UniCC Abruptly Shuts Down
UniCC controlled 30 percent of the stolen payment-card data market; leaving analysts eyeing whatβs next.
π΄ White House Meets With Software Firms and Open Source Orgs on Security π΄
π Read
via "Dark Reading".
The Log4j vulnerability is only the latest security flaw to have global impact, prompting the Biden administration and software developers to pledge to produce more secure software.π Read
via "Dark Reading".
Dark Reading
White House Meets With Software Firms and Open Source Orgs on Security
The Log4j vulnerability is only the latest security flaw to have global impact, prompting the Biden administration and software developers to pledge to produce more secure software.
β Serious Security: Linux full-disk encryption bug fixed β patch now! β
π Read
via "Naked Security".
Imagine if someone who didn't have your password could sneakily modify data that was encrypted with it.π Read
via "Naked Security".
Naked Security
Serious Security: Linux full-disk encryption bug fixed β patch now!
Imagine if someone who didnβt have your password could sneakily modify data that was encrypted with it.