‼ CVE-2022-0879 ‼
📖 Read
via "National Vulnerability Database".
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1020 ‼
📖 Read
via "National Vulnerability Database".
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0994 ‼
📖 Read
via "National Vulnerability Database".
The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24863 ‼
📖 Read
via "National Vulnerability Database".
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25120 ‼
📖 Read
via "National Vulnerability Database".
The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24859 ‼
📖 Read
via "National Vulnerability Database".
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1054 ‼
📖 Read
via "National Vulnerability Database".
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1037 ‼
📖 Read
via "National Vulnerability Database".
The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1063 ‼
📖 Read
via "National Vulnerability Database".
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
♟️ Conti’s Ransomware Toll on the Healthcare Industry ♟️
📖 Read
via "Krebs on Security".
Conti -- one of the most ruthless and successful Russian ransomware groups -- publicly declared during the height of the COVID-19 pandemic that it would refrain from targeting healthcare providers. But new information confirms this pledge was always a lie, and that Conti has launched more than 200 attacks against hospitals and other healthcare facilities since first surfacing in 2018 under the name "Ryuk."📖 Read
via "Krebs on Security".
Krebsonsecurity
Conti’s Ransomware Toll on the Healthcare Industry
Conti -- one of the most ruthless and successful Russian ransomware groups -- publicly declared during the height of the COVID-19 pandemic that it would refrain from targeting healthcare providers. But new information confirms this pledge was always a lie…
🕴 Security-as-Code Gains More Support, But Still Nascent 🕴
📖 Read
via "Dark Reading".
Google and other firms are adding security configuration to software so cloud applications and services have well-defined security settings — a key component of DevSecOps.📖 Read
via "Dark Reading".
Dark Reading
Security-as-Code Gains More Support, but Still Nascent
Google and other firms are adding security configuration to software so cloud applications and services have well-defined security settings — a key component of DevSecOps.
‼ CVE-2022-29457 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29458 ‼
📖 Read
via "National Vulnerability Database".
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.📖 Read
via "National Vulnerability Database".
🕴 Swimlane Extends Cloud-Based Security Automation into APJ Amid Momentous Growth in Region 🕴
📖 Read
via "Dark Reading".
Swimlane’s Asia-Pacific presence grows 173%, highlighting rising demand for low-code security automation.📖 Read
via "Dark Reading".
Dark Reading
Swimlane Extends Cloud-Based Security Automation into APJ Amid Momentous Growth in Region
Swimlane’s Asia-Pacific presence grows 173%, highlighting rising demand for low-code security automation.
🕴 76% of Organizations Worldwide Expect to Suffer a Cyberattack This Year 🕴
📖 Read
via "Dark Reading".
Study shows that more than 35% have suffered seven or more successful attacks.📖 Read
via "Dark Reading".
Dark Reading
76% of Organizations Worldwide Expect to Suffer a Cyberattack This Year
Study shows that more than 35% have suffered seven or more successful attacks.
‼ CVE-2022-29464 ‼
📖 Read
via "National Vulnerability Database".
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24841 ‼
📖 Read
via "National Vulnerability Database".
fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, maintainer or observer on other teams. Users are advised to upgrade to version 4.13. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-28108 ‼
📖 Read
via "National Vulnerability Database".
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1065 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.📖 Read
via "National Vulnerability Database".
🕴 Verica Launches Prowler Pro to Make AWS Security Simpler for Customers 🕴
📖 Read
via "Dark Reading".
The enterprise grade solution will provide enhanced cloud security and provide new open-source tools.📖 Read
via "Dark Reading".
Dark Reading
Verica Launches Prowler Pro to Make AWS Security Simpler for Customers
The enterprise grade solution will provide enhanced cloud security and provide new open-source tools.