‼ CVE-2021-46658 ‼
📖 Read
via "National Vulnerability Database".
save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46657 ‼
📖 Read
via "National Vulnerability Database".
get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24123 ‼
📖 Read
via "National Vulnerability Database".
MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting (XSS) payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24124 ‼
📖 Read
via "National Vulnerability Database".
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0273 ‼
📖 Read
via "National Vulnerability Database".
Improper Access Control in Pypi calibreweb prior to 0.6.16.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0339 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.📖 Read
via "National Vulnerability Database".
🔥1
‼ CVE-2022-0407 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in Conda vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0408 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow in Conda vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0413 ‼
📖 Read
via "National Vulnerability Database".
Use After Free in Conda vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23520 ‼
📖 Read
via "National Vulnerability Database".
The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0414 ‼
📖 Read
via "National Vulnerability Database".
Business Logic Errors in Packagist dolibarr/dolibarr prior to 16.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23521 ‼
📖 Read
via "National Vulnerability Database".
This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44255 ‼
📖 Read
via "National Vulnerability Database".
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.📖 Read
via "National Vulnerability Database".
🕴 The Looming CISO Mental Health Crisis — and What to Do About It, Part 2 🕴
📖 Read
via "Dark Reading".
Letting mental health issues fester may result in burnout and attrition, which affect both the company and the humans it employs.📖 Read
via "Dark Reading".
Dark Reading
The Looming CISO Mental Health Crisis — and What to Do About It, Part 2
Letting mental health issues fester may result in burnout and attrition, which affect both the company and the humans it employs.
🗓️ No smoke without fire? ‘Critical’ Loguru security flaw turns out to be non-issue 🗓️
📖 Read
via "The Daily Swig".
Invalid CVE saga highlights potential problems in the automated vulnerability alert process📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
No smoke without fire? ‘Critical’ Loguru security flaw turns out to be non-issue
Invalid CVE saga highlights potential problems in the automated vulnerability alert process
🕴 Crypto Agility: Solving for the Inevitable 🕴
📖 Read
via "Dark Reading".
The advent of viable quantum computers will threaten today’s encryption standards, which are the basis of Internet security. Cryptographic agility is the key to post-quantum computing security, although implementing it will be a formidable challenge.📖 Read
via "Dark Reading".
Dark Reading
Crypto Agility: Solving for the Inevitable
The advent of viable quantum computers will threaten today’s encryption standards, which are the basis of Internet security. Cryptographic agility is the key to post-quantum computing security, although implementing it will be a formidable challenge.
‼ CVE-2021-28962 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46101 ‼
📖 Read
via "National Vulnerability Database".
In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36056 ‼
📖 Read
via "National Vulnerability Database".
Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scripting (XSS) vulnerability via the Ping diagnostic option.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36064 ‼
📖 Read
via "National Vulnerability Database".
Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.📖 Read
via "National Vulnerability Database".
🕴 The Zero Trust Timer Is on for Federal Agencies — How Ready Are They? 🕴
📖 Read
via "Dark Reading".
A new study coincides with OMB’s finalization of its zero-trust strategy through 2024.📖 Read
via "Dark Reading".
Dark Reading
The Zero-Trust Timer Is on for Federal Agencies — How Ready Are They?
A new study coincides with OMB’s finalization of its zero-trust strategy through 2024.