‼ CVE-2022-0304 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24446 ‼
📖 Read
via "National Vulnerability Database".
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0206 ‼
📖 Read
via "National Vulnerability Database".
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0570 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25115 ‼
📖 Read
via "National Vulnerability Database".
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0571 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24976 ‼
📖 Read
via "National Vulnerability Database".
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0295 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25033 ‼
📖 Read
via "National Vulnerability Database".
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0301 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in DevTools in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24874 ‼
📖 Read
via "National Vulnerability Database".
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0305 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25050 ‼
📖 Read
via "National Vulnerability Database".
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0569 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in Packagist snipe/snipe-it prior to v5.3.9.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24110 ‼
📖 Read
via "National Vulnerability Database".
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.📖 Read
via "National Vulnerability Database".
🗓️ New Zealand government mandates bug reporting process for federal agencies 🗓️
📖 Read
via "The Daily Swig".
Researchers can report vulnerabilities on a ‘no blame’ basis📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
New Zealand government mandates bug reporting process for federal agencies
Researchers can report vulnerabilities on a ‘no blame’ basis
🕴 Ransomware Threat Intel: You're Soaking In It! 🕴
📖 Read
via "Dark Reading".
Organizations need to improve their ability to detect and prevent emerging ransomware attacks.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Threat Intel: You're Soaking In It!
Organizations need to improve their ability to detect and prevent emerging ransomware attacks.
⚠ Power company pays out $3 trillion compensation to astonished customer ⚠
📖 Read
via "Naked Security".
More money than the UK's economy produces in a year!📖 Read
via "Naked Security".
Naked Security
Power company pays out $3 trillion compensation to astonished customer
More money than the UK’s economy produces in a year!
🕴 Could Biology Hold the Clue to Better Cybersecurity? 🕴
📖 Read
via "Dark Reading".
Sophisticated malware attacks underscore the need for a more dynamic security framework, inspired by biological concepts.📖 Read
via "Dark Reading".
Dark Reading
Could Biology Hold the Clue to Better Cybersecurity?
Sophisticated malware attacks underscore the need for a more dynamic security framework, inspired by biological concepts.
‼ CVE-2021-45420 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45421 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced.📖 Read
via "National Vulnerability Database".