‼ CVE-2022-20001 ‼
📖 Read
via "National Vulnerability Database".
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the `fish_git_prompt` function from the prompt.📖 Read
via "National Vulnerability Database".
❌ Staff Think Conti Group Is a Legit Employer – Podcast ❌
📖 Read
via "Threat Post".
The ransomware group’s benefits – bonuses, employee of the month, performance reviews & top-notch training – might be better than yours, says BreachQuest’s Marco Figueroa.📖 Read
via "Threat Post".
‼ CVE-2022-24743 ‼
📖 Read
via "National Vulnerability Database".
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24742 ‼
📖 Read
via "National Vulnerability Database".
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0943 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0945 ‼
📖 Read
via "National Vulnerability Database".
Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0944 ‼
📖 Read
via "National Vulnerability Database".
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.📖 Read
via "National Vulnerability Database".
🗓️ Israeli government websites temporarily knocked offline by ‘massive’ cyber-attack 🗓️
📖 Read
via "The Daily Swig".
DDoS assault blamed on Iran, local media reports📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Israeli government websites temporarily knocked offline by ‘massive’ cyber-attack
DDoS assault blamed on Iran, local media reports
‼ CVE-2022-0893 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0894 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.📖 Read
via "National Vulnerability Database".
❌ Pandora Ransomware Hits Giant Automotive Supplier Denso ❌
📖 Read
via "Threat Post".
Denso confirmed that cybercriminals leaked stolen, classified information from the Japan-based car-components manufacturer after an attack on one of its offices in Germany.📖 Read
via "Threat Post".
Threat Post
Pandora Ransomware Hits Giant Automotive Supplier Denso
Denso confirmed that cybercriminals leaked stolen, classified information from the Japan-based car-components manufacturer after an attack on one of its offices in Germany.
🕴 SentinelOne to Buy Attivo Networks in $616.5M Deal 🕴
📖 Read
via "Dark Reading".
Attivo's identity threat detection and response is "an integral part" of SentinelOne's XDR strategy, SentinelOne CEO says.📖 Read
via "Dark Reading".
Dark Reading
SentinelOne to Buy Attivo Networks in $616.5M Deal
Attivo's identity threat detection and response is "an integral part" of SentinelOne's XDR strategy, SentinelOne CEO says.
👍1
‼ CVE-2022-0957 ‼
📖 Read
via "National Vulnerability Database".
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0954 ‼
📖 Read
via "National Vulnerability Database".
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45010 ‼
📖 Read
via "National Vulnerability Database".
Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project's Tiny File Manager 2.4.1 allows remote attackers with valid user accounts to upload malicious PHP files to the webroot and achieve code execution on the target server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0956 ‼
📖 Read
via "National Vulnerability Database".
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.📖 Read
via "National Vulnerability Database".
🕴 Windstream Enterprise Delivers Comprehensive Managed SASE Solution With Cato Networks 🕴
📖 Read
via "Dark Reading".
Windstream Enterprise’s convergence of networking and security addresses modern-day challenges of digital business transformation, cybersecurity and workforce mobility.📖 Read
via "Dark Reading".
Dark Reading
Windstream Enterprise Delivers Comprehensive Managed SASE Solution With Cato Networks
Windstream Enterprise’s convergence of networking and security addresses modern-day challenges of digital business transformation, cybersecurity and workforce mobility.
🕴 As Log4j Continues to Remind Us, What's Old Is New Again 🕴
📖 Read
via "Dark Reading".
We need to focus on the bad guys and their methods instead of playing whack-a-mole with indicators of compromise.📖 Read
via "Dark Reading".
Dark Reading
As Log4j Continues to Remind Us, What's Old Is New Again
We need to focus on the bad guys and their methods instead of playing whack-a-mole with indicators of compromise.
🕴 Cowbell Cyber Raises $100M in Series B Funding to Further Develop Cyber-Risk Underwriting 🕴
📖 Read
via "Dark Reading".
Led by Anthemis Group, funding fuels investment in go-to-market expansion, closed-loop risk management, and risk-bearing capabilities.📖 Read
via "Dark Reading".
Dark Reading
Cowbell Cyber Raises $100M in Series B Funding to Further Develop Cyber-Risk Underwriting
Led by Anthemis Group, funding fuels investment in go-to-market expansion, closed-loop risk management, and risk-bearing capabilities.
🕴 e2e-assure Launches New Microsoft Defender-Focused SOC Services 🕴
📖 Read
via "Dark Reading".
They are aimed at helping organizations kickstart their cyber-risk management.📖 Read
via "Dark Reading".
Dark Reading
e2e-assure Launches New Microsoft Defender-Focused SOC Services
They are aimed at helping organizations kickstart their cyber-risk management.
🗓️ Node.js security: Parse Server remote code execution vulnerability resolved 🗓️
📖 Read
via "The Daily Swig".
GitHub has awarded the bug a severity score of 10 – the highest available📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Node.js security: Parse Server remote code execution vulnerability resolved
GitHub has awarded the bug a severity score of 10 – the highest available