‼ CVE-2022-23646 ‼
📖 Read
via "National Vulnerability Database".
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46315 ‼
📖 Read
via "National Vulnerability Database".
Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25313 ‼
📖 Read
via "National Vulnerability Database".
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22922 ‼
📖 Read
via "National Vulnerability Database".
TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25315 ‼
📖 Read
via "National Vulnerability Database".
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25314 ‼
📖 Read
via "National Vulnerability Database".
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46108 ‼
📖 Read
via "National Vulnerability Database".
D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.📖 Read
via "National Vulnerability Database".
🗓️ Lagging behind? New study highlights weaknesses in open source patch process 🗓️
📖 Read
via "The Daily Swig".
Patch delays create a ‘window of opportunity’ for observant attackers📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Lagging behind? New study highlights weaknesses in open source patch process
Patch delays create a ‘window of opportunity’ for observant attackers
‼ CVE-2022-0660 ‼
📖 Read
via "National Vulnerability Database".
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.📖 Read
via "National Vulnerability Database".
❌ Iranian State Broadcaster Clobbered by ‘Clumsy, Buggy’ Code ❌
📖 Read
via "Threat Post".
Researchers said a Jan. 27 attack that aired footage of opposition leaders calling for assassination of Iran’s Supreme Leader was a clumsy and unsophisticated wiper attack.📖 Read
via "Threat Post".
Threat Post
Iranian State Broadcaster Clobbered by ‘Clumsy, Buggy’ Code
Researchers said a Jan. 27 attack that aired footage of opposition leaders calling for assassination of Iran’s Supreme Leader was a clumsy and unsophisticated wiper attack.
❌ Severe WordPress Plug-In UpdraftPlus Bug Threatens Backups ❌
📖 Read
via "Threat Post".
An oversight in a WordPress plug-in exposes PII and authentication data to malicious insiders.📖 Read
via "Threat Post".
Threat Post
Severe WordPress Plug-In UpdraftPlus Bug Threatens Backups
An oversight in a WordPress plug-in exposes PII and authentication data to malicious insiders.
🗓️ Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers 🗓️
📖 Read
via "The Daily Swig".
Patch now to protect, say researchers📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers
Patch now to protect, say researchers
🕴 If the Cloud Is More Secure, Then Why Is Everything Still Broken? 🕴
📖 Read
via "Dark Reading".
The sooner we discover sources of risk, the better equipped we will be to create effective mitigations for them.📖 Read
via "Dark Reading".
Dark Reading
If the Cloud Is More Secure, Then Why Is Everything Still Broken?
The sooner we discover sources of risk, the better equipped we will be to create effective mitigations for them.
🕴 Ransomware Adds New Wrinkle in Russian Cybercrime Market 🕴
📖 Read
via "Dark Reading".
Government crackdowns may destabilize Russian crime rings and strengthen their ties to Chinese allies.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Adds New Wrinkle in Russian Cybercrime Market
Government crackdowns may destabilize Russian crime rings and strengthen their ties to Chinese allies.
‼ CVE-2022-0664 ‼
📖 Read
via "National Vulnerability Database".
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25299 ‼
📖 Read
via "National Vulnerability Database".
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25298 ‼
📖 Read
via "National Vulnerability Database".
This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0451 ‼
📖 Read
via "National Vulnerability Database".
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46372 ‼
📖 Read
via "National Vulnerability Database".
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0631 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
⚠ S3 Ep70: Bitcoin, billing blunders, and 0-day after 0-day after 0-day [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen and learn!📖 Read
via "Naked Security".
Naked Security
S3 Ep70: Bitcoin, billing blunders, and 0-day after 0-day after 0-day [Podcast + Transcript]
Latest episode – listen and learn!