‼ CVE-2022-24331 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24346 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24337 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24328 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24330 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24333 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24343 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24336 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24344 ‼
📖 Read
via "National Vulnerability Database".
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24335 ‼
📖 Read
via "National Vulnerability Database".
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24342 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.📖 Read
via "National Vulnerability Database".
🕴 Top 5 Interview Questions to Ask DevOps Candidates in 2022 🕴
📖 Read
via "Dark Reading".
It's worthwhile to find candidates who have experience with models that embed security into their processes.📖 Read
via "Dark Reading".
Dark Reading
Top 5 Interview Questions to Ask DevOps Candidates in 2022
It's worthwhile to find candidates who have experience with models that embed security into their processes.
⚠ S3 Ep71: VMware escapes, PHP holes, WP plugin woes, and scary scams [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Did we learn nothing from Y2K? Why are some coders still stuck on two digit numbers? ⚠
📖 Read
via "Naked Security".
Calling all website coders: Y2K was then. V1H is now!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
❌ 6 Cyber-Defense Steps to Take Now to Protect Your Company ❌
📖 Read
via "Threat Post".
Ransomware is getting worse, but Daniel Spicer, chief security officer at Ivanti, offers a checklist for choosing defense solutions to meet the challenge.📖 Read
via "Threat Post".
Threat Post
6 Cyber-Defense Steps to Take Now to Protect Your Company
Ransomware is getting worse, but Daniel Spicer, chief security officer at Ivanti, offers a checklist for choosing defense solutions to meet the challenge.
🔏 Friday Five 2/25 🔏
📖 Read
via "".
Ransomware hits the industrial sector, behind the scenes of stalkerware network, and more - catch up on the infosec news of the week with the Friday Five!📖 Read
via "".
Digital Guardian
Friday Five 2/25
Ransomware hits the industrial sector, behind the scenes of a stalkerware network, and more - catch up on the infosec news of the week with the Friday Five!
‼ CVE-2021-38993 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial of service. IBM X-Force ID: 212962.📖 Read
via "National Vulnerability Database".
♟️ Russia Sanctions May Spark Escalating Cyber Conflict ♟️
📖 Read
via "Krebs on Security".
President Biden joined European leaders this week in enacting economic sanctions against Russia in response its military invasion of Ukraine. The West has promised tougher sanctions are coming, but experts warn these will almost certainly trigger a Russian retaliation against America and its allies, which could escalate into cyber attacks on Western financial institutions and energy infrastructure.📖 Read
via "Krebs on Security".
Krebsonsecurity
Russia Sanctions May Spark Escalating Cyber Conflict
President Biden joined European leaders this week in enacting economic sanctions against Russia in response its military invasion of Ukraine. The West has promised tougher sanctions are coming, but experts warn these will almost certainly trigger a Russian…
❌ Microsoft Exchange Bugs Exploited by ‘Cuba’ Ransomware Gang ❌
📖 Read
via "Threat Post".
The ransomware gang known as Cuba is increasingly shifting to exploiting Exchange bugs – including crooks' favorites, ProxyShell and ProxyLogon – as initial infection vectors.📖 Read
via "Threat Post".
Threat Post
Microsoft Exchange Bugs Exploited by ‘Cuba’ Ransomware Gang
The ransomware gang known as Cuba is increasingly shifting to exploiting Exchange bugs – including crooks' favorites, ProxyShell and ProxyLogon – as initial infection vectors.
🕴 Ukrainian Troops Targeted in Phishing Attacks by Suspected Belarusian APT 🕴
📖 Read
via "Dark Reading".
Ukraine's Computer Emergency Response Team calls out UNIC1151 nation-state hacking group out of Belarus as behind the attacks.📖 Read
via "Dark Reading".
Dark Reading
Ukrainian Troops Targeted in Phishing Attacks by Suspected Belarusian APT
Ukraine's Computer Emergency Response Team calls out UNIC1151 nation-state hacking group out of Belarus as behind the attacks.
‼ CVE-2022-25061 ‼
📖 Read
via "National Vulnerability Database".
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.📖 Read
via "National Vulnerability Database".