‼ CVE-2022-23627 ‼
📖 Read
via "National Vulnerability Database".
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45919 ‼
📖 Read
via "National Vulnerability Database".
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24677 ‼
📖 Read
via "National Vulnerability Database".
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0527 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Maven org.webjars.npm:github-com-chatwoot-chatwoot prior to 2.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0526 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Maven org.webjars.npm:github-com-chatwoot-chatwoot prior to 2.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0525 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24694 ‼
📖 Read
via "National Vulnerability Database".
In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24682 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.📖 Read
via "National Vulnerability Database".
🗓️ FTC set to ramp up privacy and security rule-making activity in 2022 🗓️
📖 Read
via "The Daily Swig".
Recent moves from the US government agency have laid the groundwork for significant changes to businesses’ compliance obligations, writes US attorney David Oberly📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
FTC set to ramp up privacy and security rule-making activity in 2022
Recent moves from the US government agency have laid the groundwork for significant changes to businesses’ compliance obligations, writes US attorney David Oberly
‼ CVE-2022-0536 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.📖 Read
via "National Vulnerability Database".
❌ Ex-Gumshoe Nabs Cybercrooks with FBI Tactics ❌
📖 Read
via "Threat Post".
Crane Hassold, former FBI analyst turned director of threat intel at Abnormal Security, shares stories from his covert work with cyberattackers.📖 Read
via "Threat Post".
❌ MoleRats APT Flaunts New Trojan in Latest Cyberespionage Campaign ❌
📖 Read
via "Threat Post".
Researchers from Proofpoint have spotted a new Middle East-targeted phishing campaign that delivers a novel malware dubbed NimbleMamba.📖 Read
via "Threat Post".
Threat Post
MoleRats APT Flaunts New Trojan in Latest Cyberespionage Campaign
Researchers from Proofpoint have spotted a new Middle East-targeted phishing campaign that delivers a novel malware dubbed NimbleMamba.
🗓️ Cyber-attack at Vodafone Portugal knocks mobile network services offline 🗓️
📖 Read
via "The Daily Swig".
No customer data was accessed, company claims📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Cyber-attack at Vodafone Portugal knocks mobile network services offline
No customer data was accessed, company claims
⚠ Self-styled “Crocodile of Wall Street” arrested with husband over Bitcoin megaheist ⚠
📖 Read
via "Naked Security".
The cops say they've recovered 80% of a $72 million cryptocoin heist... but the recovered funds alone are now worth over $4 billion!📖 Read
via "Naked Security".
Naked Security
Self-styled “Crocodile of Wall Street” arrested with husband over Bitcoin megaheist
The cops say they’ve recovered 80% of a $72 million cryptocoin heist… but the recovered funds alone are now worth over $4 billion!
‼ CVE-2021-46360 ‼
📖 Read
via "National Vulnerability Database".
Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46354 ‼
📖 Read
via "National Vulnerability Database".
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0538 ‼
📖 Read
via "National Vulnerability Database".
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0539 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25939 ‼
📖 Read
via "National Vulnerability Database".
In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40837 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23378 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable.📖 Read
via "National Vulnerability Database".