‼ CVE-2020-6099 ‼
📖 Read
via "National Vulnerability Database".
An exploitable code execution vulnerability exists in the file format parsing functionality of Graphisoft BIMx Desktop Viewer 2019.2.2328. A specially crafted file can cause a heap buffer overflow resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23975 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27530 ‼
📖 Read
via "National Vulnerability Database".
A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to write beyond the allocated buffer through Buffer overflow vulnerability. This vulnerability may be exploited to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42781 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3652 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27652 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42779 ‼
📖 Read
via "National Vulnerability Database".
A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3503 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3624 ‼
📖 Read
via "National Vulnerability Database".
There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28635 ‼
📖 Read
via "National Vulnerability Database".
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->facet().📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3681 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42780 ‼
📖 Read
via "National Vulnerability Database".
A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27525 ‼
📖 Read
via "National Vulnerability Database".
A malicious crafted .dwf file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current proces.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20324 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in WildFly Elytron. A variation to the use of a session fixation exploit when using Undertow was found despite Undertow switching the session ID after authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23976 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).📖 Read
via "National Vulnerability Database".
👍1
🕴 Why So Many Security Experts Are Concerned About Low-Code/No-Code Apps 🕴
📖 Read
via "Dark Reading".
IT departments must account for the business impact and security risks such applications introduce.📖 Read
via "Dark Reading".
Dark Reading
Why So Many Security Experts Are Concerned About Low-Code/No-Code Apps
IT departments must account for the business impact and security risks such applications introduce.
🕴 Security Lessons From a Payment Fraud Attack 🕴
📖 Read
via "Dark Reading".
Companies need to detect and counteract brute-force and enumeration attacks before fraudsters run away with their customers' funds.📖 Read
via "Dark Reading".
Dark Reading
Security Lessons From a Payment Fraud Attack
Companies need to detect and counteract brute-force and enumeration attacks before fraudsters run away with their customers' funds.
‼ CVE-2022-1091 ‼
📖 Read
via "National Vulnerability Database".
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1088 ‼
📖 Read
via "National Vulnerability Database".
The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1090 ‼
📖 Read
via "National Vulnerability Database".
The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0780 ‼
📖 Read
via "National Vulnerability Database".
The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax AJAX action and allowing them to perform Cross-Site Scripting attacks due to the lack of sanitisation and escaping in the customCss parameter📖 Read
via "National Vulnerability Database".