❌ Dev Sabotages Popular NPM Package to Protest Russian Invasion ❌
📖 Read
via "Threat Post".
In the latest software supply-chain attack, the code maintainer added malicious code to the hugely popular node-ipc library to replace files with a heart emoji and a peacenotwar module.📖 Read
via "Threat Post".
Threat Post
Dev Sabotages Popular NPM Package to Protest Russian Invasion
In the latest software supply-chain attack, the code maintainer added malicious code to the hugely popular node-ipc library to replace files with a heart emoji and a peacenotwar module.
🕴 Titaniam Announces Completion of Product Suite 🕴
📖 Read
via "Dark Reading".
The Titaniam Suite includes ransomware and extortion defense capabilities in the form of five products.📖 Read
via "Dark Reading".
Dark Reading
Titaniam Announces Completion of Product Suite
The Titaniam Suite includes ransomware and extortion defense capabilities in the form of five products.
🕴 Cloudflare Announces API Gateway 🕴
📖 Read
via "Dark Reading".
Organizations can secure, manage, and monitor all of their APIs in one easy-to-use dashboard.📖 Read
via "Dark Reading".
Dark Reading
Cloudflare Announces API Gateway
Organizations can secure, manage, and monitor all of their APIs in one easy-to-use dashboard.
🕴 Glasswall Launches Freemium Version of its Desktop Content Disarm and Reconstruction App 🕴
📖 Read
via "Dark Reading".
Glasswall technology offers proactive protection from file-based cybersecurity threats.📖 Read
via "Dark Reading".
Dark Reading
Glasswall Launches Freemium Version of its Desktop Content Disarm and Reconstruction App
Glasswall technology offers proactive protection from file-based cybersecurity threats.
🕴 Nok Nok Labs Unveils S3 Authentication Suite 🕴
📖 Read
via "Dark Reading".
Enhancements include support for OpenID Connect as an integration mechanism.📖 Read
via "Dark Reading".
Dark Reading
Nok Nok Labs Unveils S3 Authentication Suite
Enhancements include support for OpenID Connect as an integration mechanism.
‼ CVE-2022-26511 ‼
📖 Read
via "National Vulnerability Database".
WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26081 ‼
📖 Read
via "National Vulnerability Database".
The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25949 ‼
📖 Read
via "National Vulnerability Database".
The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25969 ‼
📖 Read
via "National Vulnerability Database".
The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.📖 Read
via "National Vulnerability Database".
👍1
🕴 ThreatMapper Updated With New Scanning Tools 🕴
📖 Read
via "Dark Reading".
ThreatMapper 1.3.0 features secret scanning and the ability to enumerate a software bill of materials (SBOM) at runtime to help secure serverless, Kubernetes, container and multi-cloud environments.📖 Read
via "Dark Reading".
Dark Reading
ThreatMapper Updated With New Scanning Tools
ThreatMapper 1.3.0 features secret scanning and the ability to enumerate a software bill of materials at runtime to help secure serverless, Kubernetes, container, and multicloud environments.
👍1
‼ CVE-2021-44907 ‼
📖 Read
via "National Vulnerability Database".
A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of property in the gs.parse function. The merge() function allows the assignment of properties on an array in the query. For any property being assigned, a value in the array is converted to an object containing these properties. Essentially, this means that the property whose expected type is Array always has to be checked with Array.isArray() by the user. This may not be obvious to the user and can cause unexpected behavior.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26500 ‼
📖 Read
via "National Vulnerability Database".
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26504 ‼
📖 Read
via "National Vulnerability Database".
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26501 ‼
📖 Read
via "National Vulnerability Database".
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46107 ‼
📖 Read
via "National Vulnerability Database".
Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45040 ‼
📖 Read
via "National Vulnerability Database".
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21822 ‼
📖 Read
via "National Vulnerability Database".
NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24770 ‼
📖 Read
via "National Vulnerability Database".
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.📖 Read
via "National Vulnerability Database".
♟️ Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware ♟️
📖 Read
via "Krebs on Security".
Researchers are tracking a number of open-source "protestware" projects on GitHub that have recently altered their code to display "Stand with Ukraine" messages for users, or basic facts about the carnage in Ukraine. The group also is tracking several code packages that were recently modified to erase files on computers that appear to be coming from Russian or Belarusian Internet addresses.📖 Read
via "Krebs on Security".
Krebs on Security
Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware
Researchers are tracking a number of open-source "protestware" projects on GitHub that have recently altered their code to display "Stand with Ukraine" messages for users, or basic facts about the carnage in Ukraine. The group also is tracking several code…
🕴 6 Reasons Not to Pay Ransomware Attackers 🕴
📖 Read
via "Dark Reading".
Paying a ransom might appear to be the best option, but it comes with its own costs.📖 Read
via "Dark Reading".
Dark Reading
6 Reasons Not to Pay Ransomware Attackers
Paying a ransom might appear to be the best option, but it comes with its own costs.