📢 CISOs reveal secrets to pandemic success in critical organisations 📢
📖 Read
via "ITPro".
The pandemic presented unique challenges for every business, but organisations tasked with delivering critical services may have worked the hardest📖 Read
via "ITPro".
IT PRO
CISOs reveal secrets to pandemic success in critical organisations | IT PRO
The pandemic presented unique challenges for every business, but organisations tasked with delivering critical services may have worked the hardest
‼ CVE-2022-0501 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38172 ‼
📖 Read
via "National Vulnerability Database".
perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0502 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23206 ‼
📖 Read
via "National Vulnerability Database".
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.📖 Read
via "National Vulnerability Database".
🗓️ Suspected data breach at Washington State Department of Licensing 🗓️
📖 Read
via "The Daily Swig".
Agency pulls POLARIS platform offline as investigation continues📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Suspected data breach at Washington State Department of Licensing
Agency pulls POLARIS platform offline as investigation continues
‼ CVE-2022-0474 ‼
📖 Read
via "National Vulnerability Database".
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0473 ‼
📖 Read
via "National Vulnerability Database".
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23320 ‼
📖 Read
via "National Vulnerability Database".
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.📖 Read
via "National Vulnerability Database".
🕴 Name That Edge Toon: Head of the Table 🕴
📖 Read
via "Dark Reading".
Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.📖 Read
via "Dark Reading".
Dark Reading
Name That Edge Toon: Head of the Table
Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.
🗓️ Email platform Zimbra issues hotfix for XSS vulnerability under active exploitation 🗓️
📖 Read
via "The Daily Swig".
Attackers have targeted mailboxes ‘in multiple waves across two attack phases’📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Email platform Zimbra issues hotfix for XSS vulnerability under active exploitation
Attackers have targeted mailboxes ‘in multiple waves across two attack phases’
🕴 Log4j: Getting From Stopgap Remedies to Long-Term Solutions 🕴
📖 Read
via "Dark Reading".
This pervasive vulnerability will require continued care and attention to fully remediate and detect permutations. Here are some ways to get started.📖 Read
via "Dark Reading".
Dark Reading
Log4j: Getting From Stopgap Remedies to Long-Term Solutions
This pervasive vulnerability will require continued care and attention to fully remediate and detect permutations. Here are some ways to get started.
‼ CVE-2021-46389 ‼
📖 Read
via "National Vulnerability Database".
IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow in iipsrv.fcgi through malformed HTTP query parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46359 ‼
📖 Read
via "National Vulnerability Database".
FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successfully, and malicious users may use this to achieve double-spending attacks.📖 Read
via "National Vulnerability Database".
🛠 Scanmycode Community Edition 🛠
📖 Read
via "Packet Storm Security".
Scanmycode is based on QuantifedCode. QuantifiedCode is a code analysis and automation platform. It helps you to keep track of issues and metrics in your software projects, and can be easily extended to support new types of analyses.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Scanmycode Community Edition ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🗓️ Equifax finalizes data breach settlement with US regulators 🗓️
📖 Read
via "The Daily Swig".
Settlement includes up to $425 million to help people affected by 2017 mega breach📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Equifax finalizes data breach settlement with US regulators
Settlement includes up to $425 million to help people affected by 2017 mega breach
⚠ Microsoft blocks web installation of its own App Installer files ⚠
📖 Read
via "Naked Security".
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2021-25114 ‼
📖 Read
via "National Vulnerability Database".
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0148 ‼
📖 Read
via "National Vulnerability Database".
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24843 ‼
📖 Read
via "National Vulnerability Database".
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25077 ‼
📖 Read
via "National Vulnerability Database".
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".