‼ CVE-2022-24764 ‼
📖 Read
via "National Vulnerability Database".
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43650 ‼
📖 Read
via "National Vulnerability Database".
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24774 ‼
📖 Read
via "National Vulnerability Database".
CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-25484 ‼
📖 Read
via "National Vulnerability Database".
tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21718 ‼
📖 Read
via "National Vulnerability Database".
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.📖 Read
via "National Vulnerability Database".
🕴 Red Canary's Annual Threat Detection Report Reveals Top Threats and Techniques Targeting Most Organizations 🕴
📖 Read
via "Dark Reading".
Report analyzes 30,000 threats in customer environments to uncover the trends, threats and techniques that comprised the 2021 threat landscape.📖 Read
via "Dark Reading".
Dark Reading
Red Canary's Annual Threat Detection Report Reveals Top Threats and Techniques Targeting Most Organizations
Report analyzes 30,000 threats in customer environments to uncover the trends, threats and techniques that comprised the 2021 threat landscape.
🕴 Ransomware Group Claims Major Okta Breach 🕴
📖 Read
via "Dark Reading".
Screenshots that ransomware gang Lapsus$ released this week suggest the threat actor also stole Microsoft source code.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Group Claims Major Okta Breach
Screenshots that ransomware gang Lapsus$ released this week suggest the threat actor also stole Microsoft source code.
‼ CVE-2022-1031 ‼
📖 Read
via "National Vulnerability Database".
Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26188 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26187 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26186 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33961 ‼
📖 Read
via "National Vulnerability Database".
A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26189 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.📖 Read
via "National Vulnerability Database".
❌ Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta ❌
📖 Read
via "Threat Post".
Lapsus$ shared screenshots of internal Okta systems and 40Gb of purportedly stolen Microsoft data on Bing, Bing Maps and Cortana.📖 Read
via "Threat Post".
Threat Post
Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta
Lapsus$ shared screenshots of internal Okta systems and 40Gb of purportedly stolen Microsoft data on Bing, Bing Maps and Cortana.
🕴 Security Teams Need to Investigate the Okta Breach Themselves 🕴
📖 Read
via "Dark Reading".
Trust, but verify. While organizations wait for official alerts and notifications from Okta, security teams should also begin their own investigations to determine whether they have been exposed.📖 Read
via "Dark Reading".
Dark Reading
Security Teams Need to Investigate the Okta Breach Themselves
Trust, but verify. While organizations wait for official alerts and notifications from Okta, security teams should also begin their own investigations to determine whether they have been exposed.
‼ CVE-2022-25518 ‼
📖 Read
via "National Vulnerability Database".
In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27666 ‼
📖 Read
via "National Vulnerability Database".
In the Linux kernel before 5.16.15, there is a buffer overflow in ESP transformation in net/ipv4/esp4.c and net/ipv6/esp6.c via a large message.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1033 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.📖 Read
via "National Vulnerability Database".
🕴 Darktrace AI Stops Cyberattack Exploiting Log4j Vulnerability at Global Financial Services Provider 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Darktrace AI Stops Cyberattack Exploiting Log4j Vulnerability at Global Financial Services Provider
CAMBRIDGE, UK, March 23, 2022 /PRNewswire/ -- Darktrace, a global leader in cyber security AI, today announced that a global provider of financial services recently detected and stopped an attacker attempting to leverage a vulnerability in Log4j to deploy…
🕴 Building a Red Team: How to Get Started 🕴
📖 Read
via "Dark Reading".
These groups of authorized hackers work to infiltrate their customer's data, development environment, or any other business area to locate and identify vulnerabilities.📖 Read
via "Dark Reading".
Dark Reading
Building a Red Team: How to Get Started
These groups of authorized hackers work to infiltrate their customer's data, development environment, or any other business area to locate and identify vulnerabilities.
🗓️ US and Canada reinstate cybercrime forum to prevent Russian cyber-attacks 🗓️
📖 Read
via "The Daily Swig".
North American nations agree to share information on key security issues📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
US and Canada reinstate cybercrime forum to prevent Russian cyber-attacks
North American nations agree to share information on key security issues