βΌ CVE-2022-0708 βΌ
π Read
via "National Vulnerability Database".
Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.π Read
via "National Vulnerability Database".
βΌ CVE-2021-44568 βΌ
π Read
via "National Vulnerability Database".
Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.π Read
via "National Vulnerability Database".
βΌ CVE-2021-27796 βΌ
π Read
via "National Vulnerability Database".
A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as either the Γ’β¬ΕuserΓ’β¬οΏ½ or Γ’β¬ΕfactoryΓ’β¬οΏ½ account, to read the contents of any file on the filesystem utilizing one of a few available binaries.π Read
via "National Vulnerability Database".
βΌ CVE-2022-25599 βΌ
π Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).π Read
via "National Vulnerability Database".
βΌ CVE-2022-23983 βΌ
π Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).π Read
via "National Vulnerability Database".
βΌ CVE-2021-27755 βΌ
π Read
via "National Vulnerability Database".
"Sametime Android potential path traversal vulnerability when using File class"π Read
via "National Vulnerability Database".
βΌ CVE-2021-27797 βΌ
π Read
via "National Vulnerability Database".
Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the system.π Read
via "National Vulnerability Database".
βΌ CVE-2021-26256 βΌ
π Read
via "National Vulnerability Database".
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).π Read
via "National Vulnerability Database".
βΌ CVE-2021-27753 βΌ
π Read
via "National Vulnerability Database".
"Sametime Android PathTraversal Vulnerability"π Read
via "National Vulnerability Database".
βΌ CVE-2022-24295 βΌ
π Read
via "National Vulnerability Database".
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL.π Read
via "National Vulnerability Database".
βΌ CVE-2021-44141 βΌ
π Read
via "National Vulnerability Database".
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.π Read
via "National Vulnerability Database".
βΌ CVE-2022-0564 βΌ
π Read
via "National Vulnerability Database".
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.π Read
via "National Vulnerability Database".
βΌ CVE-2022-23984 βΌ
π Read
via "National Vulnerability Database".
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).π Read
via "National Vulnerability Database".
βΌ CVE-2022-22308 βΌ
π Read
via "National Vulnerability Database".
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891.π Read
via "National Vulnerability Database".
βΌ CVE-2021-4115 βΌ
π Read
via "National Vulnerability Database".
There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawnedπ Read
via "National Vulnerability Database".
π1
βΌ CVE-2022-24564 βΌ
π Read
via "National Vulnerability Database".
Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user.π Read
via "National Vulnerability Database".
βΌ CVE-2022-0676 βΌ
π Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in NPM radare2.js prior to 5.6.4.π Read
via "National Vulnerability Database".
β NFT Investors Lose $1.7M in OpenSea Phishing Attack β
π Read
via "Threat Post".
Attackers took advantage of a smart-contract migration to swindle 17 users.π Read
via "Threat Post".
Threat Post
NFT Investors Lose $1.7M in OpenSea Phishing Attack
Attackers took advantage of a smart-contract migration to swindle 17 users.
ποΈ Jaw-dropping Coinbase security bug allowed users to steal unlimited cryptocurrency ποΈ
π Read
via "The Daily Swig".
Researcher nets $250,000 for βpotentially market-nukingβ vulnerabilityπ Read
via "The Daily Swig".
π₯3π1
π΄ Hidden Costs of a Data Breach π΄
π Read
via "Dark Reading".
Don't consider just the initial costs. Hidden factors include remediation, revenue loss, reputational harm, national security β even human life.π Read
via "Dark Reading".
Dark Reading
Hidden Costs of a Data Breach
Don't consider just the initial costs. Hidden factors include remediation, revenue loss, reputational harm, national security β even human life.
ποΈ AirTag clone bypassed Appleβs tracking-protection features, claims researcher ποΈ
π Read
via "The Daily Swig".
Third-party app allegedly outperforms Find My service by detecting the DIY deviceπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
AirTag clone bypassed Appleβs tracking-protection features, claims researcher
Third-party app allegedly outperforms Find My service by detecting the DIY device
π1