‼ CVE-2022-23869 ‼
📖 Read
via "National Vulnerability Database".
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1178 ‼
📖 Read
via "National Vulnerability Database".
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1155 ‼
📖 Read
via "National Vulnerability Database".
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1154 ‼
📖 Read
via "National Vulnerability Database".
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1181 ‼
📖 Read
via "National Vulnerability Database".
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24131 ‼
📖 Read
via "National Vulnerability Database".
DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1180 ‼
📖 Read
via "National Vulnerability Database".
Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1179 ‼
📖 Read
via "National Vulnerability Database".
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.📖 Read
via "National Vulnerability Database".
🕴 How Security Complexity Is Being Weaponized 🕴
📖 Read
via "Dark Reading".
As environments grow noisier, it becomes easier for attackers to intentionally create distractions.📖 Read
via "Dark Reading".
Dark Reading
How Security Complexity Is Being Weaponized
As environments grow noisier, it becomes easier for attackers to intentionally create distractions.
🗓️ ‘Dangerous’ EU web authentication plan threatens to undercut browser-led certification system, detractors claim 🗓️
📖 Read
via "The Daily Swig".
Signatories to a letter criticizing EU scheme share their misgivings with The Daily Swig📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
‘Dangerous’ EU web authentication plan threatens to undercut browser-led certification system, detractors claim
Signatories to a letter criticizing EU scheme share their misgivings with The Daily Swig
⚠ Zlib data compressor fixes 17-year-old security bug – patch, errrm, now ⚠
📖 Read
via "Naked Security".
This code is venerable! Surely all the bugs must be out by now?📖 Read
via "Naked Security".
Naked Security
Zlib data compressor fixes 17-year-old security bug – patch, errrm, now
This code is venerable! Surely all the bugs must be out by now?
🗓️ SQL injection protections in ImpressCMS could be bypassed to achieve RCE 🗓️
📖 Read
via "The Daily Swig".
Features designed to protect against SQL injection could be abused and turned against the host application📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
SQL injection protections in ImpressCMS could be bypassed to achieve RCE
Features designed to protect against SQL injection could be abused and turned against the host application
⚠ World Backup Day: 5 data recovery tips for everyone! ⚠
📖 Read
via "Naked Security".
The only backup you will ever regret is the one you didn't make📖 Read
via "Naked Security".
Naked Security
World Backup Day: 5 data recovery tips for everyone!
The only backup you will ever regret is the one you didn’t make
🔥1
🕴 Cloud Security Architecture Needs to Be Strategic, Realistic, and Based on Risk 🕴
📖 Read
via "Dark Reading".
Info-Tech Research Group has released a new research blueprint to help organizations plan the components necessary to build a cloud security architecture.📖 Read
via "Dark Reading".
Dark Reading
Cloud Security Architecture Needs to Be Strategic, Realistic, and Based on Risk
Info-Tech Research Group has released a new research blueprint to help organizations plan the components necessary to build a cloud security architecture.
‼ CVE-2022-25619 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.📖 Read
via "National Vulnerability Database".
🔥1
‼ CVE-2022-25620 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.📖 Read
via "National Vulnerability Database".
🔥1
❌ Lapsus$ ‘Back from Vacation’ ❌
📖 Read
via "Threat Post".
Lapsus$ added IT giant Globant plus 70GB of leaked data – including admin credentials for scads of customers' DevOps platforms – to its hit list.📖 Read
via "Threat Post".
Threat Post
Lapsus$ ‘Back from Vacation’
Lapsus$ added IT giant Globant plus 70GB of leaked data – including admin credentials for scads of customers' DevOps platforms – to its hit list.
❌ Google Chrome Bug Actively Exploited as Zero-Day ❌
📖 Read
via "Threat Post".
The internet giant issued an update for the bug, which is found in the open-source V8 JavaScript engine.📖 Read
via "Threat Post".
Threat Post
Google Chrome Bug Actively Exploited as Zero-Day
The internet giant issued an update for the bug, which is found in the open-source V8 JavaScript engine.
🗓️ Spring Cloud framework commits patch for code injection flaw 🗓️
📖 Read
via "The Daily Swig".
A fix appears to have been pushed but is not available in a stable release yet📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Spring Cloud framework commits patch for code injection flaw
A fix appears to have been pushed but is not available in a stable release yet
⚠ “VMWare Spring Cloud” Java bug gives instant remote code execution – update now! ⚠
📖 Read
via "Naked Security".
Easy unauthenticated remote code execution - PoC code already out📖 Read
via "Naked Security".
Naked Security
“VMware Spring Cloud Function” Java bug gives instant remote code execution – update now!
Easy unauthenticated remote code execution – PoC code already out
👍1
🕴 Cybercriminals Fighting Over Cloud Workloads for Cryptomining 🕴
📖 Read
via "Dark Reading".
Whether compromising misconfigured cloud infrastructure or taking advantage of free-tier cloud development platforms, attackers see a vast pool of workloads to use for cryptomining.📖 Read
via "Dark Reading".
Dark Reading
Cybercriminals Fighting Over Cloud Workloads for Cryptomining
Whether compromising misconfigured cloud infrastructure or taking advantage of free-tier cloud development platforms, attackers see a vast pool of workloads to use for cryptomining.