‼ CVE-2021-24919 ‼
📖 Read
via "National Vulnerability Database".
The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46253 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24944 ‼
📖 Read
via "National Vulnerability Database".
The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24900 ‼
📖 Read
via "National Vulnerability Database".
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24707 ‼
📖 Read
via "National Vulnerability Database".
The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25072 ‼
📖 Read
via "National Vulnerability Database".
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24765 ‼
📖 Read
via "National Vulnerability Database".
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0417 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in Conda vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24983 ‼
📖 Read
via "National Vulnerability Database".
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue📖 Read
via "National Vulnerability Database".
🗓️ SureMDM bug chain enabled wholesale compromise of managed devices 🗓️
📖 Read
via "The Daily Swig".
Series of flaws in MDM platform addressed in web console and Linux agent📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
SureMDM bug chain enabled wholesale compromise of managed devices
Series of flaws in MDM platform addressed in web console and Linux agent
🕴 Mastercard Launches Global Cybersecurity Alliance Program to Further Secure The Digital Ecosystem 🕴
📖 Read
via "Dark Reading".
New program helps partners accelerate growth and provide scaled delivery of critical cybersecurity and risk services.📖 Read
via "Dark Reading".
Dark Reading
Mastercard Launches Global Cybersecurity Alliance Program to Further Secure The Digital Ecosystem
New program helps partners accelerate growth and provide scaled delivery of critical cybersecurity and risk services.
🕴 Qualys Adds Advanced Remediation Capabilities to Minimize Vulnerability Risk 🕴
📖 Read
via "Dark Reading".
Update to Qualys Cloud Platform enables organizations to fix asset misconfigurations in addition to patching to achieve comprehensive remediation.📖 Read
via "Dark Reading".
Dark Reading
Qualys Adds Advanced Remediation Capabilities to Minimize Vulnerability Risk
Update to Qualys Cloud Platform enables organizations to fix asset misconfigurations in addition to patching to achieve comprehensive remediation.
🗓️ Critical Samba flaw presents code execution threat 🗓️
📖 Read
via "The Daily Swig".
Urgent patching of file-sharing technology urged📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Critical Samba flaw presents code execution threat
Urgent patching of file-sharing technology urged
‼ CVE-2021-38560 ‼
📖 Read
via "National Vulnerability Database".
Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44746 ‼
📖 Read
via "National Vulnerability Database".
UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prior, Data Maintenance Tool for DT900 Series V5.3.0.0 and prior, Data Maintenance Tool for DT800 Series V4.2.0.0 and prior allows a remote attacker who can access to the internal network, the configuration information may be obtained.📖 Read
via "National Vulnerability Database".
⚠ Website operator fined for using Google Fonts “the cloudy way” ⚠
📖 Read
via "Naked Security".
Google Fonts are OK, it seems, but only if everyone keeps their own copy of the fonts they use.📖 Read
via "Naked Security".
Naked Security
Website operator fined for using Google Fonts “the cloudy way”
Google Fonts are OK, it seems, but only if everyone keeps their own copy of the fonts they use.
🕴 Complexity vs. Capability: How to Bridge the Security Effectiveness Gap 🕴
📖 Read
via "Dark Reading".
Consolidation and automation are among the strategies for balancing security complexity and capability.📖 Read
via "Dark Reading".
Dark Reading
Complexity vs. Capability: How to Bridge the Security Effectiveness Gap
Consolidation and automation are among the strategies for balancing security complexity and capability.
⚠ Linux kernel patches “performance can be harmful” bug in video driver ⚠
📖 Read
via "Naked Security".
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.📖 Read
via "Naked Security".
Naked Security
Linux kernel patches “performance can be harmful” bug in video driver
This bug is fiendishly hard to exploit – but if you patch, it won’t be there to exploit at all.
🕴 7 Red Flags That Can Stop Your Company From Becoming a Unicorn 🕴
📖 Read
via "Dark Reading".
Investors and venture capitalists share the reasons that make them turn away from investing in your security tech.📖 Read
via "Dark Reading".
Dark Reading
7 Red Flags That Can Stop Your Company From Becoming a Unicorn
Investors and venture capitalists share the reasons that make them turn away from investing in your security tech.
❌ Samba ‘Fruit’ Bug Allows RCE, Full Root User Access ❌
📖 Read
via "Threat Post".
The issue in the file-sharing and interop platform also affects Red Hat, SUSE Linux and Ubuntu packages.📖 Read
via "Threat Post".
Threat Post
Samba ‘Fruit’ Bug Allows RCE, Full Root User Access
The issue in the file-sharing and interop platform also affects Red Hat, SUSE Linux and Ubuntu packages.
❌ The Account Takeover Cat-and-Mouse Game ❌
📖 Read
via "Threat Post".
ATO attacks are evolving. Jason Kent, hacker-in-residence at Cequence Security, discusses what new-style cyberattacks look like in the wild.📖 Read
via "Threat Post".
Threat Post
The Account Takeover Cat-and-Mouse Game
ATO attacks are evolving. Jason Kent, hacker-in-residence at Cequence Security, discusses what new-style cyberattacks look like in the wild.