📢 FBI warns of "sophisticated" LockBit 2.0 ransomware 📢
📖 Read
via "ITPro".
Bureau warns of fast, automated organization-wide encryption capability📖 Read
via "ITPro".
IT PRO
FBI warns of "sophisticated" LockBit 2.0 ransomware | IT PRO
Bureau warns of fast, automated organization-wide encryption capability
âš Apple zero-day drama for Macs, iPhones and iPads – patch now! âš
📖 Read
via "Naked Security".
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-0308 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25014 ‼
📖 Read
via "National Vulnerability Database".
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0307 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0212 ‼
📖 Read
via "National Vulnerability Database".
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0575 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25018 ‼
📖 Read
via "National Vulnerability Database".
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44879 ‼
📖 Read
via "National Vulnerability Database".
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0300 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45444 ‼
📖 Read
via "National Vulnerability Database".
In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0291 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Storage in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0200 ‼
📖 Read
via "National Vulnerability Database".
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22765 ‼
📖 Read
via "National Vulnerability Database".
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). BD Viper LT system versions 4.0 and later utilize Microsoft Windows 10 and have additional Operating System hardening configurations which increase the attack complexity required to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0176 ‼
📖 Read
via "National Vulnerability Database".
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0302 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0311 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0310 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0208 ‼
📖 Read
via "National Vulnerability Database".
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25109 ‼
📖 Read
via "National Vulnerability Database".
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24977 ‼
📖 Read
via "National Vulnerability Database".
ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.📖 Read
via "National Vulnerability Database".