‼ CVE-2022-25136 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44302 ‼
📖 Read
via "National Vulnerability Database".
BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidu_map parameters in /user/ztconfig.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25365 ‼
📖 Read
via "National Vulnerability Database".
Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24980 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0409 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25366 ‼
📖 Read
via "National Vulnerability Database".
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable.📖 Read
via "National Vulnerability Database".
‼ CVE-2016-20013 ‼
📖 Read
via "National Vulnerability Database".
sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24979 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference (IDOR), with the potential of exposing internal content elements.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25256 ‼
📖 Read
via "National Vulnerability Database".
SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0678 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0630 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0632 ‼
📖 Read
via "National Vulnerability Database".
NULL Pointer Dereference in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0690 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.📖 Read
via "National Vulnerability Database".
‼ CVE-2016-1239 ‼
📖 Read
via "National Vulnerability Database".
duck before 0.10 did not properly handle loading of untrusted code from the current directory..📖 Read
via "National Vulnerability Database".
📢 IT Pro News In Review: Nvidia breaks off Arm deal, FCDO security attack, Microsoft to disable VBA 📢
📖 Read
via "ITPro".
Catch up on the biggest headlines of the week in just two minutes📖 Read
via "ITPro".
ITPro
IT Pro News In Review: Nvidia breaks off Arm deal, FCDO security attack, Microsoft to disable VBA
Catch up on the biggest headlines of the week in just two minutes
📢 Texas sues Facebook for misusing facial recognition data 📢
📖 Read
via "ITPro".
State wants up to $25,000 per alleged violation for discontinued program📖 Read
via "ITPro".
IT PRO
Texas sues Facebook for misusing facial recognition data | IT PRO
State wants up to $25,000 per alleged violation for discontinued program
📢 Mid-sized businesses on hackers’ 2022 hit list, cyber agencies warn 📢
📖 Read
via "ITPro".
Cyber criminals are "shifting away from big-game hunting", say FBI and NCSC📖 Read
via "ITPro".
IT PRO
Mid-sized businesses on hackers’ 2022 hit list, cyber agencies warn | IT PRO
Cyber criminals are “shifting away from “big-game” hunting", says FBI and NCSC
📢 Google doubles bug bounty rewards for Linux, Kubernetes exploits 📢
📖 Read
via "ITPro".
The increased rewards are said to align better with the community's expectations of a bug bounty programme of this kind📖 Read
via "ITPro".
ITPro
Google doubles bug bounty rewards for Linux, Kubernetes exploits
The increased rewards are said to align better with the community's expectations of a bug bounty programme of this kind
👍1
📢 What is a 502 bad gateway and how do you fix it? 📢
📖 Read
via "ITPro".
We explain what this networking error means for users and website owners📖 Read
via "ITPro".
IT PRO
What is a 502 Bad Gateway and how do you fix it? | IT PRO
We explain what the 502 Bad Gateway networking error means for users and website owners, and some potential steps for fixing it
📢 Apple users told to update their devices to fix critical WebKit flaw 📢
📖 Read
via "ITPro".
The security flaw allowed code execution on a range of devices and represents the third major vulnerability to be patched by Apple this year📖 Read
via "ITPro".
IT PRO
Apple users told to update their devices to fix critical WebKit flaw | IT PRO
The security flaw allowed code execution on a range of devices and represents the third major vulnerability to be patched by Apple this year