‼ CVE-2022-24479 ‼
📖 Read
via "National Vulnerability Database".
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44497 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, can cause the bounds of a for loop to be miscalculated, which leads to a use after free condition a pointer is pushed into previously free memory by the loop.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24481 ‼
📖 Read
via "National Vulnerability Database".
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24521.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21983 ‼
📖 Read
via "National Vulnerability Database".
Win32 Stream Enumeration Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24534.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44482 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to do_verify in sr_unix/do_verify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26811 ‼
📖 Read
via "National Vulnerability Database".
Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.📖 Read
via "National Vulnerability Database".
🔏 Friday Five 4/15 🔏
📖 Read
via "".
In this week’s Friday Five, catch up on the latest attacks from Russian and North Korean hackers, a shocking report on businesses’ willingness to prioritize security, why consumers are caring less about their own security, and more!📖 Read
via "".
Digital Guardian
Friday Five 4/15
In this week’s Friday Five, catch up on the latest attacks from Russian and North Korean hackers, a shocking report on businesses’ willingness to prioritize security, why consumers are caring less about their own security, and more!
‼ CVE-2022-27427 ‼
📖 Read
via "National Vulnerability Database".
A zero-code remote code injection vulnerability via configuration.php in Chamilo LMS v1.11.13 allows attackers to upload arbitrary code in the form of a new plugin.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29072 ‼
📖 Read
via "National Vulnerability Database".
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27423 ‼
📖 Read
via "National Vulnerability Database".
Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27426 ‼
📖 Read
via "National Vulnerability Database".
A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27422 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24279 ‼
📖 Read
via "National Vulnerability Database".
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27425 ‼
📖 Read
via "National Vulnerability Database".
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27421 ‼
📖 Read
via "National Vulnerability Database".
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29281 ‼
📖 Read
via "National Vulnerability Database".
Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program (or theft of NTLM credentials via an SMB relay attack, because the application resolves UNC paths).📖 Read
via "National Vulnerability Database".
🕴 Google Emergency Update Fixes Chrome Zero-Day 🕴
📖 Read
via "Dark Reading".
Google patches a critical flaw in its Chrome browser, bringing its count of zero-day vulnerabilities fixed in 2022 to four.📖 Read
via "Dark Reading".
Dark Reading
Google Emergency Update Fixes Chrome Zero-Day
Google patches a critical flaw in its Chrome browser, bringing its count of zero-day vulnerabilities fixed in 2022 to four.
‼ CVE-2022-1365 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.📖 Read
via "National Vulnerability Database".
⚠ Yet another Chrome zero-day emergency update – patch now! ⚠
📖 Read
via "Naked Security".
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.📖 Read
via "Naked Security".
👍1
‼ CVE-2022-29020 ‼
📖 Read
via "National Vulnerability Database".
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29287 ‼
📖 Read
via "National Vulnerability Database".
Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).📖 Read
via "National Vulnerability Database".