‼ CVE-2022-22300 ‼
📖 Read
via "National Vulnerability Database".
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43077 ‼
📖 Read
via "National Vulnerability Database".
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP monitor handlers.📖 Read
via "National Vulnerability Database".
❌ RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now! ❌
📖 Read
via "Threat Post".
The flaws are in the ubiquitous open-source PJSIP multimedia communication library, used by the Asterisk PBX toolkit that's found in a massive number of VoIP implementations.📖 Read
via "Threat Post".
Threat Post
RCE Bugs in Hugely Popular VoIP Apps: Patch Now!
The flaws are in the ubiquitous open-source PJSIP multimedia communication library, used by the Asterisk PBX toolkit that's found in a massive number of VoIP implementations.
🕴 IRONSCALES Expands Product Offering Across Email, Communication Platforms 🕴
📖 Read
via "Dark Reading".
New solutions protect customers from expanding threats to cybersecurity landscape.📖 Read
via "Dark Reading".
Dark Reading
IRONSCALES Expands Product Offering Across Email, Communication Platforms
New solutions protect customers from expanding threats to cybersecurity landscape.
🕴 Cyberattacks in Ukraine Soon Could Spill Over to Other Countries 🕴
📖 Read
via "Dark Reading".
Email-borne attacks out of Russia have already targeted at least a few US and European organizations.📖 Read
via "Dark Reading".
Dark Reading
Cyberattacks in Ukraine Could Soon Spillover to Other Countries
Email-borne attacks out of Russia have already targeted at least a few US and European organizations.
‼ CVE-2022-24719 ‼
📖 Read
via "National Vulnerability Database".
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin. A workaround has been identified by using a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0577 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22303 ‼
📖 Read
via "National Vulnerability Database".
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9 may allow a low privileged authenticated user to gain access to the FortiGate users credentials via the config conflict file.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-22301 ‼
📖 Read
via "National Vulnerability Database".
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44166 ‼
📖 Read
via "National Vulnerability Database".
An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.📖 Read
via "National Vulnerability Database".
🗓️ Remote code execution vulnerability uncovered in Hashnode blogging platform 🗓️
📖 Read
via "The Daily Swig".
A local file coding error could be exploited to trigger RCE📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Remote code execution vulnerability uncovered in Hashnode blogging platform
A local file coding error could be exploited to trigger RCE
‼ CVE-2022-23395 ‼
📖 Read
via "National Vulnerability Database".
jQuery Cookie 1.4.1 is affected by parameter pollution, which can lead to DOM cross-site scripting (XSS).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0829 ‼
📖 Read
via "National Vulnerability Database".
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0824 ‼
📖 Read
via "National Vulnerability Database".
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.📖 Read
via "National Vulnerability Database".
👍1
📢 IT Pro News In Review: UK likely to pay ransom, OnwardMobility shuts, and Russia blamed for hacks 📢
📖 Read
via "ITPro".
Catch up on the biggest headlines of the week in just two minutes📖 Read
via "ITPro".
IT PRO
IT Pro News In Review: UK likely to pay ransom, OnwardMobility shuts, and Russia blamed for hacks
Catch up on the biggest headlines of the week in just two minutes
📢 Conti ransomware gang data leaked by Ukrainian cyber researcher 📢
📖 Read
via "ITPro".
The data includes internal chat logs between members and affiliates of the group, unveiling their personal details, conflicts, and accusations📖 Read
via "ITPro".
IT PRO
Conti ransomware gang data leaked by Ukrainian cyber researcher | IT PRO
The data includes internal chat logs between members and affiliates of the group, unveiling their personal details, conflicts, and accusations
📢 Hacking group leaks Nvidia data following alleged ransomware attack 📢
📖 Read
via "ITPro".
LAPSU$ claims to have released Nvidia source code and highly confidential GPU driver data📖 Read
via "ITPro".
IT PRO
Hacking group leaks Nvidia data following alleged ransomware attack | IT PRO
LAPSU$ claims to have released Nvidia source code and highly confidential GPU driver data
📢 Russian cyber attacks on Ukraine: What we know so far 📢
📖 Read
via "ITPro".
A score of additional attacks on the Ukrainian government and other critical services have been reported this week, as Russia officially declares war on the country📖 Read
via "ITPro".
IT Pro
Russian cyber attacks on Ukraine: What we know so far
The conflict between Russia and Ukraine has set the tone for all future wars, and the cyber attacks observed throughout will provide a how-to guide on handling simultaneous cyber and kinetic warfare
🗓️ Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’ 🗓️
📖 Read
via "The Daily Swig".
Education institutions hit by more than 100,000 attacks in 24 hours📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’
Education institutions hit by more than 100,000 attacks in 24 hours
🕴 Reduce Risk With Better Cyber Due Diligence 🕴
📖 Read
via "Dark Reading".
Done incorrectly, due diligence can result in slower integration of assets, which increases acquisition costs associated and could reduce expected gains.📖 Read
via "Dark Reading".
Dark Reading
Reduce Risk With Better Cyber Due Diligence
Done incorrectly, due diligence can result in slower integration of assets, which increases acquisition costs associated and could reduce expected gains.
🕴 NeuraLegion Rebrands as Bright Security 🕴
📖 Read
via "Dark Reading".
Also announces $20 million Series A funding round led by Evolution Equity Partners.📖 Read
via "Dark Reading".
Dark Reading
NeuraLegion Rebrands as Bright Security
Also announces $20 million Series A funding round led by Evolution Equity Partners.