‼ CVE-2021-46115 ‼
📖 Read
via "National Vulnerability Database".
jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29838 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29845 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. IBM X-Force ID: 205255.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46383 ‼
📖 Read
via "National Vulnerability Database".
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46386 ‼
📖 Read
via "National Vulnerability Database".
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: File Upload. The impact is: execute arbitrary code (remote). The component is: net.mingsoft.basic.action.web.FileAction#upload. The attack vector is: jspx webshell. ¶¶ MCMS has a file upload vulnerability through which attacker can upload a webshell. Successful attacks of this vulnerability can result in takeover of MCMS📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46118 ‼
📖 Read
via "National Vulnerability Database".
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0368 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read in Conda vim prior to 8.2.📖 Read
via "National Vulnerability Database".
❌ Cybercriminals Love Supply-Chain Chaos: Here’s How to Protect Your Inbox ❌
📖 Read
via "Threat Post".
Threat actors use bogus 'shipping delays' to deceive customers and businesses. Troy Gill, senior manager of threat intelligence at Zix, discusses how spoofing is evolving and what to do.📖 Read
via "Threat Post".
Threat Post
Cybercriminals Love Supply-Chain Chaos: Here’s How to Protect Your Inbox
Threat actors use bogus 'shipping delays' to deceive customers and businesses. Troy Gill, senior manager of threat intelligence at Zix, discusses how spoofing is evolving and what to do.
🔏 Ransomware Groups Turning to Insiders to Help with Attacks 🔏
📖 Read
via "".
A new survey suggests there's been an uptick in ransomware groups reaching out to employees in hopes they can help them carry out attacks against their company.📖 Read
via "".
Digital Guardian
Ransomware Groups Turning to Insiders to Help with Attacks
A new survey suggests there's been an uptick in ransomware groups reaching out to employees in hopes they can help them carry out attacks against their company.
❌ New Year, New Threats: 4 Tips to Activate Your Best Cyber-Defense ❌
📖 Read
via "Threat Post".
Need a blueprint for architecting a formidable cyber-defense? Kerry Mandiant, senior director at Mandiant, shares hers in this detailed breakdown.📖 Read
via "Threat Post".
Threat Post
New Year, New Threats: 4 Tips to Activate Your Best Cyber-Defense
Need a blueprint for architecting a formidable cyber-defense? Kerry Matre, senior director at Mandiant, shares hers in this detailed breakdown.
‼ CVE-2022-23993 ‼
📖 Read
via "National Vulnerability Database".
/usr/local/www/pkg.php in pfSense through 2.5.2 uses $_REQUEST['pkg_filter'] in a PHP echo call.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22850 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_types.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21686 ‼
📖 Read
via "National Vulnerability Database".
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23990 ‼
📖 Read
via "National Vulnerability Database".
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46114 ‼
📖 Read
via "National Vulnerability Database".
jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22852 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_list.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46385 ‼
📖 Read
via "National Vulnerability Database".
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.📖 Read
via "National Vulnerability Database".
❌ ‘Dark Herring’ Billing Malware Swims onto 105M Android Devices ❌
📖 Read
via "Threat Post".
The mobile malware heisted hundreds of millions of dollars from unsuspecting users, thanks to 470 different well-crafted malicious app in Google Play.📖 Read
via "Threat Post".
Threat Post
‘Dark Herring’ Billing Malware Swims onto 105M Android Devices
The mobile malware heisted hundreds of millions of dollars from unsuspecting users, thanks to 470 different well-crafted malicious app in Google Play.
📢 Dark Souls servers taken offline after RCE flaw identified 📢
📖 Read
via "ITPro".
Experts say PowerShell scripts could have been launched on other players' machines as a result📖 Read
via "ITPro".
IT PRO
Dark Souls servers taken offline after RCE flaw identified | IT PRO
Experts say PowerShell scripts could have been launched on other players' machines as a result
📢 DDoS attacks are still a key weapon for corporate extortion 📢
📖 Read
via "ITPro".
Ransomware isn’t the only rotten fruit, with DDoS attacks deployed both as an extra twist of the knife – and on their own📖 Read
via "ITPro".
IT PRO
DDoS attacks are still a key weapon for corporate extortion | IT PRO
Ransomware isn’t the only rotten fruit, with DDoS attacks deployed both as an extra twist of the knife – and on their own
📢 UK's first government cyber strategy aims to bolster public sector defences 📢
📖 Read
via "ITPro".
The NCSC found that almost half of all cyber incidents recorded between 2020 and 2021 were aimed at the public sector📖 Read
via "ITPro".
IT PRO
UK's first government cyber strategy aims to bolster public sector defences | IT PRO
The NCSC found that almost half of all cyber incidents recorded between 2020 and 2021 were aimed at the public sector