‼ CVE-2022-22851 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44692 ‼
📖 Read
via "National Vulnerability Database".
BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. JohnDoe@example.com would become /members/johndoeexample-com and Jo.test@example.com would become /members/jo-testexample-com. The members list is available to everyone and (in a default configuration) often without authentication. It is therefore trivial to collect a list of email addresses.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45975 ‼
📖 Read
via "National Vulnerability Database".
In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local attacker to perform a DLL hijacking attack. This vulnerability is due to incorrect handling of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with local administrator privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46117 ‼
📖 Read
via "National Vulnerability Database".
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0378 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43334 ‼
📖 Read
via "National Vulnerability Database".
BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0379 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.📖 Read
via "National Vulnerability Database".
🗓️ Fantasy Premier League account hack surge prompts plans to introduce extra login checks for football fans 🗓️
📖 Read
via "The Daily Swig".
FA (belatedly) says OK to 2FA📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Fantasy Premier League account hack surge prompts plans to introduce extra login checks for football fans
FA (belatedly) says OK to 2FA
⚠ Tax scam emails are alive and well as US tax season starts ⚠
📖 Read
via "Naked Security".
If in doubt, don't give it out! (And don't forget that no reply is often a good reply.)📖 Read
via "Naked Security".
Naked Security
Tax scam emails are alive and well as US tax season starts
If in doubt, don’t give it out! (And don’t forget that no reply is often a good reply.)
❌ Linux Bug in All Major Distros: ‘An Attacker’s Dream Come True’ ❌
📖 Read
via "Threat Post".
The 12-year-old flaw in the sudo-like polkit’s pkexec tool, found in all major Linux distributions, is likely to be exploited in the wild within days.📖 Read
via "Threat Post".
Threat Post
Linux Bug in All Major Distros: ‘An Attacker’s Dream Come True’
The 12-year-old flaw in the sudo-like Polkit’s pkexec tool, found in all major Linux distributions, is likely to be exploited in the wild within days.
🕴 Cybersecurity Is Broken: How We Got Here & How to Start Fixing It 🕴
📖 Read
via "Dark Reading".
It's not just your imagination — malicious threats have exponentially increased organizational risk.📖 Read
via "Dark Reading".
Dark Reading
Cybersecurity Is Broken: How We Got Here & How to Start Fixing It
It's not just your imagination — malicious threats have exponentially increased organizational risk.
⚠ “PwnKit” security bug gets you root on most Linux distros – what to do ⚠
📖 Read
via "Naked Security".
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell📖 Read
via "Naked Security".
Naked Security
“PwnKit” security bug gets you root on most Linux distros – what to do
An elevation of privilege bug that could let a “mostly harmless” user give themselves a instant root shell
🕴 Experts Urge Firms to Patch Trivial-to-Exploit Flaw in Linux PolicyKit 🕴
📖 Read
via "Dark Reading".
The memory corruption vulnerability in a policy component installed by default on most Linux distributions allows any user to become root. Researchers have already reproduced the exploit.📖 Read
via "Dark Reading".
Dark Reading
Experts Urge Firms to Patch Trivial-to-Exploit Flaw in Linux PolicyKit
The memory corruption vulnerability in a policy component installed by default on most Linux distributions allows any user to become root. Researchers have already reproduced the exploit.
‼ CVE-2021-29846 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 205256.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46561 ‼
📖 Read
via "National Vulnerability Database".
controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new organization.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46116 ‼
📖 Read
via "National Vulnerability Database".
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46115 ‼
📖 Read
via "National Vulnerability Database".
jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29838 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29845 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. IBM X-Force ID: 205255.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46383 ‼
📖 Read
via "National Vulnerability Database".
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46386 ‼
📖 Read
via "National Vulnerability Database".
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: File Upload. The impact is: execute arbitrary code (remote). The component is: net.mingsoft.basic.action.web.FileAction#upload. The attack vector is: jspx webshell. ¶¶ MCMS has a file upload vulnerability through which attacker can upload a webshell. Successful attacks of this vulnerability can result in takeover of MCMS📖 Read
via "National Vulnerability Database".