‼ CVE-2022-23327 ‼
📖 Read
via "National Vulnerability Database".
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0752 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23328 ‼
📖 Read
via "National Vulnerability Database".
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).📖 Read
via "National Vulnerability Database".
🗓️ RCE vulnerability in Dynamicweb enterprise software could allow server compromise 🗓️
📖 Read
via "The Daily Swig".
‘Extremely easy to exploit’ bug introduced to codebase in 2018, say researchers📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
RCE vulnerability in Dynamicweb enterprise software could allow server compromise
‘Extremely easy to exploit’ bug introduced to codebase in 2018, say researchers
🕴 DORA's Global Reach and Why Enterprises Need to Prepare 🕴
📖 Read
via "Dark Reading".
The new EU regulation is a response to the rise of ransomware attacks and other new cyberthreats that have proliferated in the wake of the global pandemic.📖 Read
via "Dark Reading".
Dark Reading
DORA's Global Reach and Why Enterprises Need to Prepare
The new EU regulation is a response to the rise of ransomware attacks and other new cyberthreats that have proliferated in the wake of the global pandemic.
‼ CVE-2021-46393 ‼
📖 Read
via "National Vulnerability Database".
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check,which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46394 ‼
📖 Read
via "National Vulnerability Database".
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43392 ‼
📖 Read
via "National Vulnerability Database".
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26201 ‼
📖 Read
via "National Vulnerability Database".
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44321 ‼
📖 Read
via "National Vulnerability Database".
Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0831 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43393 ‼
📖 Read
via "National Vulnerability Database".
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0832 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.📖 Read
via "National Vulnerability Database".
🗓️ Japanese beauty retailer Acro blames third-party hack for breach of 100k payment cards 🗓️
📖 Read
via "The Daily Swig".
Company traces compromise to vulnerability in payment processor’s systems📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Japanese beauty retailer Acro blames third-party hack for breach of 100k payment cards
Company traces compromise to vulnerability in payment processor’s systems
⚠ S3 Ep72: AirTag stalking, web server coding woes and Instascams [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now (or read it, if that's your preference)...📖 Read
via "Naked Security".
Naked Security
S3 Ep72: AirTag stalking, web server coding woes and Instascams [Podcast + Transcript]
Latest episode – listen now (or read it, if that’s your preference)…
❌ Free HermeticRansom Ransomware Decryptor Released ❌
📖 Read
via "Threat Post".
Cruddy cryptography means victims whose files have been encrypted by the Ukraine-tormenting ransomware can break the chains without paying extortionists.📖 Read
via "Threat Post".
Threat Post
Free HermeticRansom Ransomware Decryptor Released
Cruddy cryptography means victims whose files have been encrypted by the Ukraine-tormenting ransomware can break the chains without paying extortionists.
‼ CVE-2020-18327 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23729 ‼
📖 Read
via "National Vulnerability Database".
When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46381 ‼
📖 Read
via "National Vulnerability Database".
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46379 ‼
📖 Read
via "National Vulnerability Database".
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2021-46382 ‼
📖 Read
via "National Vulnerability Database".
Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.📖 Read
via "National Vulnerability Database".