‼ CVE-2022-21815 ‼
📖 Read
via "National Vulnerability Database".
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42833 ‼
📖 Read
via "National Vulnerability Database".
A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings.📖 Read
via "National Vulnerability Database".
❌ LockBit, BlackCat, Swissport, Oh My! Ransomware Activity Stays Strong ❌
📖 Read
via "Threat Post".
However, groups are rebranding and recalibrating their profiles and tactics to respond to law enforcement and the security community's focus on stopping ransomware attacks.📖 Read
via "Threat Post".
Threat Post
LockBit, BlackCat, Swissport, Oh My! Ransomware Activity Stays Strong
However, groups are rebranding and recalibrating their profiles and tactics to respond to law enforcement and the security community's focus on stopping ransomware attacks.
❌ Medusa Malware Joins Flubot’s Android Distribution Network ❌
📖 Read
via "Threat Post".
Two powerful trojans with spyware and RAT capabilities are being delivered in side-by-side campaigns using a common infrastructure.📖 Read
via "Threat Post".
Threat Post
Medusa Malware Joins Flubot’s Android Distribution Network
Two powerful trojans with spyware and RAT capabilities are being delivered in side-by-side campaigns using a common infrastructure.
❌ CISA Orders Federal Agencies to Fix Actively Exploited Windows Bug ❌
📖 Read
via "Threat Post".
Feb. 18 is the deadline to patch a bug that affects all unpatched versions of Windows 10 and requires zero user interaction to exploit.📖 Read
via "Threat Post".
Threat Post
CISA Orders Federal Agencies to Fix Actively Exploited Windows Bug
Feb. 18 is the deadline to patch a bug that affects all unpatched versions of Windows 10 and requires zero user interaction to exploit.
🕴 FBI Publishes Indicators of Compromise for LockBit 2.0 Ransomware 🕴
📖 Read
via "Dark Reading".
Flash bulletin alert includes mitigation strategies for defending against the ransomware.📖 Read
via "Dark Reading".
Dark Reading
FBI Publishes Indicators of Compromise for LockBit 2.0 Ransomware
Flash bulletin alert includes mitigation strategies for defending against the ransomware.
‼ CVE-2022-23613 ‼
📖 Read
via "National Vulnerability Database".
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21712 ‼
📖 Read
via "National Vulnerability Database".
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45281 ‼
📖 Read
via "National Vulnerability Database".
QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this parameter is not properly sanitized.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3861 ‼
📖 Read
via "National Vulnerability Database".
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3835 ‼
📖 Read
via "National Vulnerability Database".
Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf📖 Read
via "National Vulnerability Database".
🕴 Russian APT Steps Up Malicious Cyber Activity in Ukraine 🕴
📖 Read
via "Dark Reading".
Actinium/Gameredon's attacks are another reminder of why organizations need to pay additional scrutiny to systems in the region.📖 Read
via "Dark Reading".
Dark Reading
Russian APT Steps Up Malicious Cyber Activity in Ukraine
Actinium/Gameredon's attacks are another reminder of why organizations need to pay additional scrutiny to systems in the region.
‼ CVE-2022-23623 ‼
📖 Read
via "National Vulnerability Database".
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23624 ‼
📖 Read
via "National Vulnerability Database".
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0509 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22146 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21241 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0508 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery (SSRF) in NPM @peertube/embed-api prior to Not released yet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21193 ‼
📖 Read
via "National Vulnerability Database".
Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspecified vectors.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21173 ‼
📖 Read
via "National Vulnerability Database".
Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v1.05 and earlier, WRH-300DR3-S firmware v1.05 and earlier, WRH-300LB3-S firmware v1.05 and earlier, WRH-300PN3-S firmware v1.05 and earlier, WRH-300WH3-S firmware v1.05 and earlier, and WRH-300YG3-S firmware v1.05 and earlier) allows an attacker on the adjacent network to execute an arbitrary OS command via unspecified vectors.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22142 ‼
📖 Read
via "National Vulnerability Database".
Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.📖 Read
via "National Vulnerability Database".