‼ CVE-2022-25016 ‼
📖 Read
via "National Vulnerability Database".
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2021-43070 ‼
📖 Read
via "National Vulnerability Database".
Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22350 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220394.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38996 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213076.📖 Read
via "National Vulnerability Database".
🕴 Companies' Code Leaking More Passwords and Secrets 🕴
📖 Read
via "Dark Reading".
Software code pushed to online code repositories exposed twice as many secrets compared to last year, putting organizations' security at risk.📖 Read
via "Dark Reading".
Dark Reading
Companies' Code Leaking More Passwords and Secrets
Software code pushed to online code repositories exposed twice as many secrets compared to last year, putting organizations' security at risk.
🔏 Senate Passes Act That Would Require Disclosing Cyberattacks 🔏
📖 Read
via "".
The Senate has passed legislation that among other requirements, would require critical infrastructure entities to report to the federal government when they are hacked.📖 Read
via "".
Digital Guardian
Senate Passes Act That Would Require Disclosing Cyberattacks
The Senate has passed legislation that among other requirements, would require critical infrastructure entities to report to the federal government when they are hacked.
🕴 Researchers Devise Attack for Stealing Data During Homomorphic Encryption 🕴
📖 Read
via "Dark Reading".
A vulnerability in a Microsoft crypto library gives attackers a way to figure out what data is being encrypted in lockpicker-like fashion.📖 Read
via "Dark Reading".
Dark Reading
Researchers Devise Attack for Stealing Data During Homomorphic Encryption
A vulnerability in a Microsoft crypto library gives attackers a way to figure out what data is being encrypted in lockpicker-like fashion.
‼ CVE-2021-38268 ‼
📖 Read
via "National Vulnerability Database".
The Dynamic Data Mapping module in Liferay Portal through v7.3.6 and Liferay DXP through v7.3 incorrectly sets default permissions for site members, allowing authenticated attackers to add and duplicate forms via the UI or the API.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23878 ‼
📖 Read
via "National Vulnerability Database".
seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23640 ‼
📖 Read
via "National Vulnerability Database".
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.📖 Read
via "National Vulnerability Database".
🕴 7 Ways to Secure Collaboration Tools in Your Organization 🕴
📖 Read
via "Dark Reading".
The push to embrace Slack, Teams, and Zoom at work comes with new security risks for organizations.📖 Read
via "Dark Reading".
Dark Reading
7 Ways to Secure Collaboration Tools in Your Organization
The push to embrace Slack, Teams, and Zoom at work comes with new security risks for organizations.
👍1
❌ TeaBot Trojan Haunts Google Play Store, Again ❌
📖 Read
via "Threat Post".
Malicious Google Play apps have circumvented censorship by hiding trojans in software updates.📖 Read
via "Threat Post".
Threat Post
TeaBot Trojan Haunts Google Play Store, Again
Malicious Google Play apps have circumvented censorship by hiding trojans in software updates.
‼ CVE-2022-23958 ‼
📖 Read
via "National Vulnerability Database".
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41001 ‼
📖 Read
via "National Vulnerability Database".
An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0711 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23954 ‼
📖 Read
via "National Vulnerability Database".
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23656 ‼
📖 Read
via "National Vulnerability Database".
Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code controlled by the attacker. Users running a Zulip server from the main branch should upgrade from main (2022-03-01 or later) again to deploy this fix.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41003 ‼
📖 Read
via "National Vulnerability Database".
Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0675 ‼
📖 Read
via "National Vulnerability Database".
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23957 ‼
📖 Read
via "National Vulnerability Database".
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22944 ‼
📖 Read
via "National Vulnerability Database".
VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window.📖 Read
via "National Vulnerability Database".