‼ CVE-2022-0519 ‼
📖 Read
via "National Vulnerability Database".
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0523 ‼
📖 Read
via "National Vulnerability Database".
Expired Pointer Dereference in NPM radare2.js prior to 5.6.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0520 ‼
📖 Read
via "National Vulnerability Database".
Use After Free in NPM radare2.js prior to 5.6.2.📖 Read
via "National Vulnerability Database".
🕴 Microsoft Issues 51 CVEs for Patch Tuesday, None 'Critical' 🕴
📖 Read
via "Dark Reading".
One publicly known flaw — an elevation-of-privilege bug in Windows Kernel — was included in the patches.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Issues 51 CVEs for Patch Tuesday, None 'Critical'
One publicly known flaw — an elevation-of-privilege bug in Windows Kernel — was included in the patches.
♟️ Microsoft Patch Tuesday, February 2022 Edition ♟️
📖 Read
via "Krebs on Security".
Microsoft today released software updates to plug security holes in its Windows operating systems and related software. This month's relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it does fix four dozen flaws, including several that Microsoft says will likely soon be exploited by malware or malcontents.📖 Read
via "Krebs on Security".
Krebsonsecurity
Microsoft Patch Tuesday, February 2022 Edition
Microsoft today released software updates to plug security holes in its Windows operating systems and related software. This month's relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it…
‼ CVE-2022-24676 ‼
📖 Read
via "National Vulnerability Database".
update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45329 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23627 ‼
📖 Read
via "National Vulnerability Database".
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45919 ‼
📖 Read
via "National Vulnerability Database".
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24677 ‼
📖 Read
via "National Vulnerability Database".
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0527 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Maven org.webjars.npm:github-com-chatwoot-chatwoot prior to 2.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0526 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Maven org.webjars.npm:github-com-chatwoot-chatwoot prior to 2.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0525 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24694 ‼
📖 Read
via "National Vulnerability Database".
In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24682 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.📖 Read
via "National Vulnerability Database".
🗓️ FTC set to ramp up privacy and security rule-making activity in 2022 🗓️
📖 Read
via "The Daily Swig".
Recent moves from the US government agency have laid the groundwork for significant changes to businesses’ compliance obligations, writes US attorney David Oberly📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
FTC set to ramp up privacy and security rule-making activity in 2022
Recent moves from the US government agency have laid the groundwork for significant changes to businesses’ compliance obligations, writes US attorney David Oberly
‼ CVE-2022-0536 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.📖 Read
via "National Vulnerability Database".
❌ Ex-Gumshoe Nabs Cybercrooks with FBI Tactics ❌
📖 Read
via "Threat Post".
Crane Hassold, former FBI analyst turned director of threat intel at Abnormal Security, shares stories from his covert work with cyberattackers.📖 Read
via "Threat Post".
❌ MoleRats APT Flaunts New Trojan in Latest Cyberespionage Campaign ❌
📖 Read
via "Threat Post".
Researchers from Proofpoint have spotted a new Middle East-targeted phishing campaign that delivers a novel malware dubbed NimbleMamba.📖 Read
via "Threat Post".
Threat Post
MoleRats APT Flaunts New Trojan in Latest Cyberespionage Campaign
Researchers from Proofpoint have spotted a new Middle East-targeted phishing campaign that delivers a novel malware dubbed NimbleMamba.
🗓️ Cyber-attack at Vodafone Portugal knocks mobile network services offline 🗓️
📖 Read
via "The Daily Swig".
No customer data was accessed, company claims📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Cyber-attack at Vodafone Portugal knocks mobile network services offline
No customer data was accessed, company claims
⚠ Self-styled “Crocodile of Wall Street” arrested with husband over Bitcoin megaheist ⚠
📖 Read
via "Naked Security".
The cops say they've recovered 80% of a $72 million cryptocoin heist... but the recovered funds alone are now worth over $4 billion!📖 Read
via "Naked Security".
Naked Security
Self-styled “Crocodile of Wall Street” arrested with husband over Bitcoin megaheist
The cops say they’ve recovered 80% of a $72 million cryptocoin heist… but the recovered funds alone are now worth over $4 billion!