โผ CVE-2022-23697 โผ
๐ Read
via "National Vulnerability Database".
A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.๐ Read
via "National Vulnerability Database".
๐ด Qualys Delivers Multi-Vector EDR 2.0 with Enhanced Prioritization to Quickly Surface the Most Critical Incidents ๐ด
๐ Read
via "Dark Reading".
EDR solution provides comprehensive threat detection and reduces the risk of compromise with vulnerability management and patching all from a single agent.๐ Read
via "Dark Reading".
Dark Reading
Qualys Delivers Multi-Vector EDR 2.0 with Enhanced Prioritization to Quickly Surface the Most Critical Incidents
EDR solution provides comprehensive threat detection and reduces the risk of compromise with vulnerability management and patching all from a single agent.
๐ด Citrixยฎ Modernizes Security to Accommodate Hybrid Work ๐ด
๐ Read
via "Dark Reading".
Company launches cloud delivered, Zero Trust Network Access solution that protects all apps, data and devices, enabling secure work from anywhere.๐ Read
via "Dark Reading".
Dark Reading
Citrixยฎ Modernizes Security to Accommodate Hybrid Work
Company launches cloud delivered, Zero Trust Network Access solution that protects all apps, data and devices, enabling secure work from anywhere.
๐ด State Department Announces Bureau of Cyberspace and Digital Policy ๐ด
๐ Read
via "Dark Reading".
The newly created bureau will help shape norms of responsible government behavior in cyberspace and help US allies bolster their own cybersecurity programs.๐ Read
via "Dark Reading".
Dark Reading
State Department Announces Bureau of Cyberspace and Digital Policy
The newly created bureau will help shape norms of responsible government behavior in cyberspace and help US allies bolster their own cybersecurity programs.
โผ CVE-2022-1236 โผ
๐ Read
via "National Vulnerability Database".
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-25154 โผ
๐ Read
via "National Vulnerability Database".
A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows 7, 10, or 11 to exploit this vulnerability.)๐ Read
via "National Vulnerability Database".
โผ CVE-2022-23909 โผ
๐ Read
via "National Vulnerability Database".
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-1235 โผ
๐ Read
via "National Vulnerability Database".
Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.๐ Read
via "National Vulnerability Database".
๐๏ธ Singaporean cybersecurity agency launches certification scheme for businesses ๐๏ธ
๐ Read
via "The Daily Swig".
Program comprises separate security marks aimed at SMEs and enterprises๐ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Singaporean cybersecurity agency launches certification scheme for businesses
Program comprises separate security marks aimed at SMEs and enterprises
โผ CVE-2021-38834 โผ
๐ Read
via "National Vulnerability Database".
easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code.๐ Read
via "National Vulnerability Database".
โ No-Joke Borat RAT Propagates Ransomware, DDoS โ
๐ Read
via "Threat Post".
This fresh malware strain extends the functionality of typical trojans with advanced functionality and a series of modules for launching various types of threat activity.๐ Read
via "Threat Post".
Threat Post
No-Joke Borat RAT Propagates Ransomware, DDoS
This fresh malware strain extends the functionality of typical trojans with advanced functionality and a series of modules for launching various types of threat activity.
๐ด How to Prepare for Cyber Threats During the Russian Invasion of Ukraine ๐ด
๐ Read
via "Dark Reading".
Remain calm, maintain control, and triage responses appropriately to ensure that the organization can remain resilient against threats during this crisis and through others to come.๐ Read
via "Dark Reading".
Dark Reading
How to Prepare for Cyber Threats During the Russian Invasion of Ukraine
Remain calm, maintain control, and triage responses appropriately to ensure that the organization can remain resilient against threats during this crisis and through others to come.
๐ด FIN7 Morphs into a Broader, More Dangerous Cybercrime Group ๐ด
๐ Read
via "Dark Reading".
Mandiant has now tied the group to at least eight unattributed clusters of activity targeting organizations across various industries and regions.๐ Read
via "Dark Reading".
Dark Reading
FIN7 Morphs into a Broader, More Dangerous Cybercrime Group
Mandiant has now tied the group to at least eight unattributed clusters of activity targeting organizations across various industries and regions.
โผ CVE-2022-26358 โผ
๐ Read
via "National Vulnerability Database".
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-26360 โผ
๐ Read
via "National Vulnerability Database".
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-26361 โผ
๐ Read
via "National Vulnerability Database".
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-26359 โผ
๐ Read
via "National Vulnerability Database".
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-26357 โผ
๐ Read
via "National Vulnerability Database".
race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.๐ Read
via "National Vulnerability Database".
โผ CVE-2022-26356 โผ
๐ Read
via "National Vulnerability Database".
Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.๐ Read
via "National Vulnerability Database".
๐๏ธ Trend Micro warns of active attacks against Apex Central console ๐๏ธ
๐ Read
via "The Daily Swig".
Scramble to patch security dashboard๐ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Trend Micro warns of active attacks against Apex Central console
Scramble to patch security dashboard
โ Googleโs monthly Android updates patch numerous โget rootโ holes โ
๐ Read
via "Naked Security".
Get the update now... if it's available for your phone. Here's how to check.๐ Read
via "Naked Security".
Naked Security
Googleโs monthly Android updates patch numerous โget rootโ holes
Get the update nowโฆ if itโs available for your phone. Hereโs how to check.