‼ CVE-2022-22703 ‼
📖 Read
via "National Vulnerability Database".
In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0245 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44757 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server.📖 Read
via "National Vulnerability Database".
🗓️ Researchers discover ‘extremely easy’ 2FA bypass in Box cloud management software 🗓️
📖 Read
via "The Daily Swig".
Breaking the Box📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Researchers discover ‘extremely easy’ 2FA bypass in Box cloud management software
Breaking the Box
❌ Organizations Face a ‘Losing Battle’ Against Vulnerabilities ❌
📖 Read
via "Threat Post".
Companies must take more ‘innovative and proactive’ approaches to security in 2022 to combat threats that emerged last year, researchers said.📖 Read
via "Threat Post".
Threat Post
Organizations Face a ‘Losing Battle’ Against Vulnerabilities
Companies must take more ‘innovative and proactive’ approaches to security in 2022 to combat threats that emerged last year, researchers said.
🕴 5 Reasons Why M&A Is the Engine Driving Cybersecurity 🕴
📖 Read
via "Dark Reading".
Consistent acquisition of key technologies and talent is a proven strategy for growth.📖 Read
via "Dark Reading".
Dark Reading
5 Reasons Why M&A Is the Engine Driving Cybersecurity
Consistent acquisition of key technologies and talent is a proven strategy for growth.
🕴 How to Avoid Putting Data At Risk During the Great Resignation 🕴
📖 Read
via "Dark Reading".
Never before have companies offboarded employees at this pace, making it more likely that some processes, from protecting data to revoking the employee's access, will slip through the cracks.📖 Read
via "Dark Reading".
🦿 DHL takes top spot as most imitated brand in phishing attacks 🦿
📖 Read
via "Tech Republic".
For the final quarter of 2021, DHL surpassed Microsoft as the brand most spoofed in phishing campaigns, says Check Point Research.📖 Read
via "Tech Republic".
TechRepublic
DHL takes top spot as most imitated brand in phishing attacks
For the final quarter of 2021, DHL surpassed Microsoft as the brand most spoofed in phishing campaigns, says Check Point Research.
‼ CVE-2021-38783 ‼
📖 Read
via "National Vulnerability Database".
There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_INFO and IOCTL_COPY_PROC_INFO, which could cause a system crash or EoP.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22566 ‼
📖 Read
via "National Vulnerability Database".
An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. This can be leveraged by an attacker to bypass executability restrictions of kernel-mode pages from user-mode. An incorrect setting of PXN bits within mmu_flags_to_s1_pte_attr lead to unprivileged executable pages being mapped as executable from a privileged context. This can be leveraged by an attacker to bypass executability restrictions of user-mode pages from kernel-mode. Typically this allows a potential attacker to circumvent a mitigation, making exploitation of potential kernel-mode vulnerabilities easier. We recommend updating kernel beyond commit 7d731b4e9599088ac3073956933559da7bca6a00 and rebuilding.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33965 ‼
📖 Read
via "National Vulnerability Database".
China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_enable and mesh_device have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38694 ‼
📖 Read
via "National Vulnerability Database".
SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38785 ‼
📖 Read
via "National Vulnerability Database".
There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev that could use the ioctl cmd IOCTL_GET_IOMMU_ADDR to cause a system crash.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38784 ‼
📖 Read
via "National Vulnerability Database".
There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malicious file to cause a system crash.📖 Read
via "National Vulnerability Database".
🗓️ Chrome to bolster CSRF protections with CORS preflight checks on private network requests 🗓️
📖 Read
via "The Daily Swig".
Phased rollout begins from Chrome 98 with DevTools warnings of failed preflight requests📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Chrome to bolster CSRF protections with CORS preflight checks on private network requests
Phased rollout begins from Chrome 98 with DevTools warnings of failed preflight requests
❌ Critical ManageEngine Desktop Server Bug Opens Orgs to Malware ❌
📖 Read
via "Threat Post".
Zoho's comprehensive endpoint-management platform suffers from an authentication-bypass bug (CVE-2021-44757) that could lead to remote code execution.📖 Read
via "Threat Post".
Threat Post
Critical ManageEngine Desktop Server Bug Opens Orgs to Malware
Zoho's comprehensive endpoint-management platform suffers from an authentication-bypass bug (CVE-2021-44757) that could lead to remote code execution.
🕴 Name That Toon: Nowhere to Hide 🕴
📖 Read
via "Dark Reading".
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.📖 Read
via "Dark Reading".
Dark Reading
Name That Toon: Nowhere to Hide
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.
‼ CVE-2021-38695 ‼
📖 Read
via "National Vulnerability Database".
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38697 ‼
📖 Read
via "National Vulnerability Database".
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0262 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23302 ‼
📖 Read
via "National Vulnerability Database".
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.📖 Read
via "National Vulnerability Database".