‼ CVE-2022-24712 ‼
📖 Read
via "National Vulnerability Database".
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.📖 Read
via "National Vulnerability Database".
🗓️ Bug Bounty Radar // The latest bug bounty programs for March 2022 🗓️
📖 Read
via "The Daily Swig".
New web targets for the discerning hacker📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Bug Bounty Radar // The latest bug bounty programs for March 2022
New web targets for the discerning hacker
❌ Toyota to Close Japan Plants After Suspected Cyberattack ❌
📖 Read
via "Threat Post".
The plants will shut down on Tuesday, halting about a third of the company’s global production. Toyota doesn’t know how long the 14 plants will be unplugged.📖 Read
via "Threat Post".
Threat Post
Toyota to Close Japan Plants After Suspected Cyberattack
The plants will shut down on Tuesday, halting about a third of the company’s global production. Toyota doesn’t know how long the 14 plants will be unplugged.
🕴 Researchers Warn of Stealthy Chinese Backdoor Targeting Multiple Foreign Agencies 🕴
📖 Read
via "Dark Reading".
A stealthy backdoor program used by China-linked threat actors has targeted government computers at multiple foreign agencies, allowing attackers to retain a presence on sensitive networks and exfiltrate data while remaining undetected.📖 Read
via "Dark Reading".
Dark Reading
Researchers Warn of Stealthy Chinese Backdoor Targeting Multiple Foreign Agencies
A stealthy backdoor program used by China-linked threat actors has targeted government computers at multiple foreign agencies, allowing attackers to retain a presence on sensitive networks and exfiltrate data while remaining undetected.
👍1
⚠ Did we learn nothing from Y2K? Why are some coders still stuck on two digit numbers? ⚠
📖 Read
via "Naked Security".
Calling all website coders: Y2K was then. V1H is now!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Instagram scammers as busy as ever: passwords and 2FA codes at risk ⚠
📖 Read
via "Naked Security".
Instagram scams don't seem to be dying out - we're seeing more variety and trickiness than ever...📖 Read
via "Naked Security".
‼ CVE-2021-44331 ‼
📖 Read
via "National Vulnerability Database".
ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44342 ‼
📖 Read
via "National Vulnerability Database".
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494".📖 Read
via "National Vulnerability Database".
🔏 New Report Pushes for Strong Intellectual Property Protection 🔏
📖 Read
via "".
The report encourages the United States to engage like-minded partners on new tools to counter IP theft and better protect IP at home for trade purposes.📖 Read
via "".
❌ Ukraine-Russia Cyber Warzone Splits Cyber Underground ❌
📖 Read
via "Threat Post".
A pro-Ukraine Conti member spilled 13 months of the ransomware group's chats, while cyber actors are rushing to align with both sides.📖 Read
via "Threat Post".
Threat Post
Ukraine-Russia Cyber Warzone Splits Cyber Underground
A pro-Ukraine Conti member spilled 13 months of the ransomware group's chats, while cyber actors are rushing to align with both sides.
‼ CVE-2022-26315 ‼
📖 Read
via "National Vulnerability Database".
qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25023 ‼
📖 Read
via "National Vulnerability Database".
Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25013 ‼
📖 Read
via "National Vulnerability Database".
Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22845 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25014 ‼
📖 Read
via "National Vulnerability Database".
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41112 ‼
📖 Read
via "National Vulnerability Database".
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25015 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41111 ‼
📖 Read
via "National Vulnerability Database".
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22844 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26181 ‼
📖 Read
via "National Vulnerability Database".
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108.📖 Read
via "National Vulnerability Database".
🕴 Invicti Security Adds Software Composition Analysis to Its Industry- Leading AppSec Platform 🕴
📖 Read
via "Dark Reading".
Invicti SCA enables users to track and secure open-source components to reduce security risk.📖 Read
via "Dark Reading".
Dark Reading
Invicti Security Adds Software Composition Analysis to Its Industry- Leading AppSec Platform
Invicti SCA enables users to track and secure open-source components to reduce security risk.