‼ CVE-2021-38986 ‼
📖 Read
via "National Vulnerability Database".
IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23387 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in taocms 3.0.2. This is a SQL blind injection that can obtain database data through the Comment Update field.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36166 ‼
📖 Read
via "National Vulnerability Database".
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36171 ‼
📖 Read
via "National Vulnerability Database".
The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22321 ‼
📖 Read
via "National Vulnerability Database".
IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38955 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due to a file creation vulnerability in the audit commands. IBM X-Force ID: 211825.📖 Read
via "National Vulnerability Database".
♟️ Conti Ransomware Group Diaries, Part I: Evasion ♟️
📖 Read
via "Krebs on Security".
A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to Conti, an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million in annual revenue. The chat logs offer a fascinating glimpse into the challenges of running a sprawling criminal enterprise with more than 100 salaried employees. The records also provide insight into how Conti has dealt with its own internal breaches and attacks from private security firms and foreign governments.📖 Read
via "Krebs on Security".
Krebs on Security
Conti Ransomware Group Diaries, Part I: Evasion
A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to Conti, an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million…
🕴 What Do I Need to Know for SaaS Security? 🕴
📖 Read
via "Dark Reading".
Most importantly, someone needs to step forward and take it on as their job.📖 Read
via "Dark Reading".
Dark Reading
What Do I Need to Know for SaaS Security?
Most importantly, someone needs to step forward and take it on as their job.
‼ CVE-2021-43075 ‼
📖 Read
via "National Vulnerability Database".
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the alarm dashboard and controller config handlers.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32586 ‼
📖 Read
via "National Vulnerability Database".
An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15936 ‼
📖 Read
via "National Vulnerability Database".
A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive information via SNI Client Hello TLS packets.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24718 ‼
📖 Read
via "National Vulnerability Database".
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24717 ‼
📖 Read
via "National Vulnerability Database".
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.5.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41193 ‼
📖 Read
via "National Vulnerability Database".
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22300 ‼
📖 Read
via "National Vulnerability Database".
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43077 ‼
📖 Read
via "National Vulnerability Database".
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP monitor handlers.📖 Read
via "National Vulnerability Database".
❌ RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now! ❌
📖 Read
via "Threat Post".
The flaws are in the ubiquitous open-source PJSIP multimedia communication library, used by the Asterisk PBX toolkit that's found in a massive number of VoIP implementations.📖 Read
via "Threat Post".
Threat Post
RCE Bugs in Hugely Popular VoIP Apps: Patch Now!
The flaws are in the ubiquitous open-source PJSIP multimedia communication library, used by the Asterisk PBX toolkit that's found in a massive number of VoIP implementations.
🕴 IRONSCALES Expands Product Offering Across Email, Communication Platforms 🕴
📖 Read
via "Dark Reading".
New solutions protect customers from expanding threats to cybersecurity landscape.📖 Read
via "Dark Reading".
Dark Reading
IRONSCALES Expands Product Offering Across Email, Communication Platforms
New solutions protect customers from expanding threats to cybersecurity landscape.
🕴 Cyberattacks in Ukraine Soon Could Spill Over to Other Countries 🕴
📖 Read
via "Dark Reading".
Email-borne attacks out of Russia have already targeted at least a few US and European organizations.📖 Read
via "Dark Reading".
Dark Reading
Cyberattacks in Ukraine Could Soon Spillover to Other Countries
Email-borne attacks out of Russia have already targeted at least a few US and European organizations.
‼ CVE-2022-24719 ‼
📖 Read
via "National Vulnerability Database".
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin. A workaround has been identified by using a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0577 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.📖 Read
via "National Vulnerability Database".