🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-0103 ‼

Insufficient control flow management in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-22954 ‼

A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-21133 ‼

Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service via local access.

📖 Read

via "National Vulnerability Database".
67 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-33105 ‼

Out-of-bounds read in some Intel(R) Core(TM) processors with Radeon(TM) RX Vega M GL integrated graphics before version 21.10 may allow an authenticated user to potentially enable information disclosure via local access.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-22544 ‼

Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service.

📖 Read

via "National Vulnerability Database".
68 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-33061 ‼

Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.

📖 Read

via "National Vulnerability Database".
63 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0530 ‼

A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of an utf-8 string to a local string that leads to a segmentation fault. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

📖 Read

via "National Vulnerability Database".
66 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-26616 ‼

An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-0118 ‼

Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
60 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-20024 ‼

In system service, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219064; Issue ID: ALPS06219064.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-22532 ‼

In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session.

📖 Read

via "National Vulnerability Database".
63 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-0169 ‼

Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-23049 ‼

Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-20025 ‼

In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06126832; Issue ID: ALPS06126832.

📖 Read

via "National Vulnerability Database".
63 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-21174 ‼

Improper access control in a third-party component of Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-37109 ‼

There is a security protection bypass vulnerability with the modem.Successful exploitation of this vulnerability may cause memory protection failure.

📖 Read

via "National Vulnerability Database".
62 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24319 ‼

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-20039 ‼

In ccu driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06183345; Issue ID: ALPS06183345.

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24320 ‼

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA database server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-21226 ‼

Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclosure via local access.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-22536 ‼

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

📖 Read

via "National Vulnerability Database".
62 views