⚠ “Dirty Pipe” Linux kernel bug lets anyone write to any file ⚠
📖 Read
via "Naked Security".
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-0482 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0896 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.📖 Read
via "National Vulnerability Database".
👍1
🗓️ Government agencies in Ukraine targeted in cyber-attacks deploying MicroBackdoor malware 🗓️
📖 Read
via "The Daily Swig".
A number of state bodies have been attacked since Russia’s invasion began📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Government agencies in Ukraine targeted in cyber-attacks deploying MicroBackdoor malware
A number of state bodies have been attacked since Russia’s invasion began
❌ Russian APTs Furiously Phish Ukraine – Google ❌
📖 Read
via "Threat Post".
Also on the rise: DDoS attacks against Ukrainian sites and phishing activity capitalizing on the conflict, with China's Mustang Panda targeting Europe.📖 Read
via "Threat Post".
Threat Post
Russian APTs Furiously Phish Ukraine – Google
Also on the rise: DDoS attacks against Ukrainian sites and phishing activity capitalizing on the conflict, with China's Mustang Panda targeting Europe.
🕴 Zero Trust Can't Stop at the Federal Level 🕴
📖 Read
via "Dark Reading".
The federal government must step in to help local and state governments implement zero trust.📖 Read
via "Dark Reading".
Dark Reading
Zero Trust Can't Stop at the Federal Level
The federal government must step in to help local and state governments implement zero trust.
🗓️ Critical Axeda vulnerabilities pose takeover risk to hundreds of IoT devices 🗓️
📖 Read
via "The Daily Swig".
Serious supply chain threat posed to downstream medical devices in particular📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Critical Axeda vulnerabilities pose takeover risk to hundreds of IoT devices
Serious supply chain threat posed to downstream medical devices in particular
🛠 UFONet 1.8 🛠
📖 Read
via "Packet Storm Security".
UFONet abuses OSI Layer 7-HTTP to create/manage 'zombies' and to conduct different attacks using GET/POST, multi-threading, proxies, origin spoofing methods, cache evasion techniques, etc.📖 Read
via "Packet Storm Security".
Packetstormsecurity
UFONet 1.8 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ Most ServiceNow Instances Misconfigured, Exposed ❌
📖 Read
via "Threat Post".
Customers aren't locking down access correctly, leading to ~70 percent of ServiceNow implementations being vulnerable to malicious data extraction.📖 Read
via "Threat Post".
Threat Post
Most ServiceNow Instances Misconfigured, Exposed
Customers aren't locking down access correctly, leading to ~70 percent of ServiceNow implementations tested by AppOmni being vulnerable to malicious data extraction.
♟️ Microsoft Patch Tuesday, March 2022 Edition ♟️
📖 Read
via "Krebs on Security".
Microsoft on Tuesday released software updates to plug at least 70 security holes in its Windows operating systems and related software. For the second month running, there are no scary zero-day threats looming for Windows users (that we know of), and relatively few "critical" fixes. And yet we know from experience that attackers are already trying to work out how to turn these patches into a roadmap for exploiting the flaws they fix. Here's a look at the security weaknesses Microsoft says are most likely to be targeted first.📖 Read
via "Krebs on Security".
Krebsonsecurity
Microsoft Patch Tuesday, March 2022 Edition
Microsoft on Tuesday released software updates to plug at least 70 security holes in its Windows operating systems and related software. For the second month running, there are no scary zero-day threats looming for Windows users (that we know of),…
🗓️ Exploit chain allows security researchers to pwn phone system 🗓️
📖 Read
via "The Daily Swig".
Cloudy with a chance of exploits📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Exploit chain allows security researchers to compromise Pascom phone systems
Cloudy with a chance of exploits
‼ CVE-2022-23265 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Defender for IoT Remote Code Execution Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24464 ‼
📖 Read
via "National Vulnerability Database".
.NET and Visual Studio Denial of Service Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24453 ‼
📖 Read
via "National Vulnerability Database".
HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22006, CVE-2022-22007, CVE-2022-23301, CVE-2022-24452, CVE-2022-24456.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23286 ‼
📖 Read
via "National Vulnerability Database".
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-23297 ‼
📖 Read
via "National Vulnerability Database".
Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24507 ‼
📖 Read
via "National Vulnerability Database".
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24522 ‼
📖 Read
via "National Vulnerability Database".
Skype Extension for Chrome Information Disclosure Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24520 ‼
📖 Read
via "National Vulnerability Database".
Azure Site Recovery Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24467, CVE-2022-24468, CVE-2022-24470, CVE-2022-24471, CVE-2022-24517.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24510 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Office Visio Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24461, CVE-2022-24509.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24471 ‼
📖 Read
via "National Vulnerability Database".
Azure Site Recovery Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24467, CVE-2022-24468, CVE-2022-24470, CVE-2022-24517, CVE-2022-24520.📖 Read
via "National Vulnerability Database".