πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-25389 β€Ό

DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_management.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-26266 β€Ό

Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-27226 β€Ό

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-0991 β€Ό

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24125 β€Ό

The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24126 β€Ό

A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25462 β€Ό

Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26007 β€Ό

An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42194 β€Ό

The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-39384 β€Ό

DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26008 β€Ό

The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via uploading a crafted PHP file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-39383 β€Ό

DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Rust patches sneaky ReDoS bug πŸ—“οΈ

Regex defenses restored to thwart resource consumption trap

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Crowdsourced Efforts Get Leveraged in Ukraine Conflict πŸ•΄

The battle is not just being waged in the physical world β€” it's also happening online. And average people are taking part, not just governments.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Will the Biggest Clouds Win? Lessons From Google's Mandiant Buy πŸ•΄

Google eventually won out in the competition for Mandiant, but Microsoft's interest underscores the trend in consolidation of security services into large cloud providers, experts say.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Ransomware Attack Led Bridgestone to Halt US Tire Production for a Week πŸ•΄

Japanese manufacturer confirmed a Feb. 27 attack on its US subsidiary that led to a temporary production shutdown.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-1035 β€Ό

Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25570 β€Ό

In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder (with the default permission model) can extend his permissions to all other password lists in the same folder.

πŸ“– Read

via "National Vulnerability Database".
❌ Bridgestone Hit as Ransomware Torches Toyota Supply Chain ❌

A ransomware attack struck Bridgestone Americas, weeks after another Toyota supplier experienced the same and a third reported some kind of cyber hit.

πŸ“– Read

via "Threat Post".
⚠ OpenSSL patches infinite-loop DoS bug in certificate verification ⚠

When it comes to writing loops in your code... never sit on the fence!

πŸ“– Read

via "Naked Security".
πŸ‘1
β€Ό CVE-2020-24772 β€Ό

In Dreamacro 1.1.0, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking).

πŸ“– Read

via "National Vulnerability Database".