🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-33105 ‼

Out-of-bounds read in some Intel(R) Core(TM) processors with Radeon(TM) RX Vega M GL integrated graphics before version 21.10 may allow an authenticated user to potentially enable information disclosure via local access.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-22544 ‼

Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service.

📖 Read

via "National Vulnerability Database".
68 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-33061 ‼

Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.

📖 Read

via "National Vulnerability Database".
63 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0530 ‼

A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of an utf-8 string to a local string that leads to a segmentation fault. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

📖 Read

via "National Vulnerability Database".
66 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-26616 ‼

An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-0118 ‼

Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
60 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-20024 ‼

In system service, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219064; Issue ID: ALPS06219064.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-22532 ‼

In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session.

📖 Read

via "National Vulnerability Database".
63 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-0169 ‼

Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-23049 ‼

Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-20025 ‼

In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06126832; Issue ID: ALPS06126832.

📖 Read

via "National Vulnerability Database".
63 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-21174 ‼

Improper access control in a third-party component of Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-37109 ‼

There is a security protection bypass vulnerability with the modem.Successful exploitation of this vulnerability may cause memory protection failure.

📖 Read

via "National Vulnerability Database".
62 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24319 ‼

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-20039 ‼

In ccu driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06183345; Issue ID: ALPS06183345.

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24320 ‼

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA database server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

📖 Read

via "National Vulnerability Database".
64 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-21226 ‼

Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclosure via local access.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-22536 ‼

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

📖 Read

via "National Vulnerability Database".
62 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-0072 ‼

Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable information disclosure via local access.

📖 Read

via "National Vulnerability Database".
61 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24668 ‼

A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.

📖 Read

via "National Vulnerability Database".
65 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-33139 ‼

Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.

📖 Read

via "National Vulnerability Database".
64 views