‼ CVE-2021-40060 ‼
📖 Read
via "National Vulnerability Database".
There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24930 ‼
📖 Read
via "National Vulnerability Database".
An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to reset default app settings without a proper permission📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25816 ‼
📖 Read
via "National Vulnerability Database".
Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26104 ‼
📖 Read
via "National Vulnerability Database".
SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40055 ‼
📖 Read
via "National Vulnerability Database".
There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24609 ‼
📖 Read
via "National Vulnerability Database".
Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25555 ‼
📖 Read
via "National Vulnerability Database".
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ntpServer parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25826 ‼
📖 Read
via "National Vulnerability Database".
Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in the log📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24607 ‼
📖 Read
via "National Vulnerability Database".
Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24397 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.This reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content of portal Website. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25547 ‼
📖 Read
via "National Vulnerability Database".
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44632 ‼
📖 Read
via "National Vulnerability Database".
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/upgrade_info feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22795 ‼
📖 Read
via "National Vulnerability Database".
Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40047 ‼
📖 Read
via "National Vulnerability Database".
There is a vulnerability of memory not being released after effective lifetime in the Bastet module. Successful exploitation of this vulnerability may affect integrity.📖 Read
via "National Vulnerability Database".
❌ Malware Posing as Russia DDoS Tool Bites Pro-Ukraine Hackers ❌
📖 Read
via "Threat Post".
Be careful when downloading a tool to cyber-target Russia: It could be an infostealer wolf dressed in sheep's clothing that grabs your cryptocurrency info instead.📖 Read
via "Threat Post".
Threat Post
Malware Posing as Russia DDoS Tool Bites Pro-Ukraine Hackers
Be careful when downloading a tool to cyber-target Russia: It could be an infostealer wolf dressed in sheep's clothing that grabs your cryptocurrency info instead.
👍1
🕴 Ex-Canadian Government Employee Charged in NetWalker Ransomware Attacks 🕴
📖 Read
via "Dark Reading".
Sebastien Vachon-Desjardins of Gatineau, Quebec, Canada, allegedly responsible for some $28 million in ransomware losses from victims in the US.📖 Read
via "Dark Reading".
Dark Reading
Ex-Canadian Government Employee Charged in NetWalker Ransomware Attacks
Sebastien Vachon-Desjardins of Gatineau, Quebec, Canada, allegedly responsible for some $28 million in ransomware losses from victims in the US.
🕴 Spotlight on First Dan Kaminsky Fellow: Jonathan Leitschuh 🕴
📖 Read
via "Dark Reading".
Human Security honors its late co-founder with a fellowship to fund smart and passionate cybersecurity advocates to do open source work for common good.📖 Read
via "Dark Reading".
Dark Reading
Spotlight on First Dan Kaminsky Fellow: Jonathan Leitschuh
Human Security honors its late co-founder with a fellowship to fund smart and passionate cybersecurity advocates to do open source work for common good.
‼ CVE-2021-39022 ‼
📖 Read
via "National Vulnerability Database".
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID: 213858.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39025 ‼
📖 Read
via "National Vulnerability Database".
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web backend is down. IBM X-Force 213863.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23036 ‼
📖 Read
via "National Vulnerability Database".
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23040 ‼
📖 Read
via "National Vulnerability Database".
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042📖 Read
via "National Vulnerability Database".