‼ CVE-2022-0645 ‼
📖 Read
via "National Vulnerability Database".
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26595 ‼
📖 Read
via "National Vulnerability Database".
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41570 ‼
📖 Read
via "National Vulnerability Database".
Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26593 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43129 ‼
📖 Read
via "National Vulnerability Database".
An Access Control vulnerability exists in Desire2Learn/D2L Learning Management System (LMS) 20.21.7 via the quizzing feature, which allows a remote malicious user to disable the Disable right click control.📖 Read
via "National Vulnerability Database".
🛠 XDNR Shellcode Cryptor / Encoder 🛠
📖 Read
via "Packet Storm Security".
X0R Cryptor with DEC/N0T/R0R encoder plus random byte insertion.📖 Read
via "Packet Storm Security".
Packetstormsecurity
XDNR Shellcode Cryptor / Encoder ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
⚠ Beanstalk cryptocurrency heist: scammer votes himself all the money ⚠
📖 Read
via "Naked Security".
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
❌ Protect Your Executives’ Cybersecurity Amidst Global Cyberwar ❌
📖 Read
via "Threat Post".
In this time of unprecedented cyberwar, organizations must protect the personal digital lives of their executives in order to reduce the company’s risk of direct or collateral damage.📖 Read
via "Threat Post".
Threat Post
Protect Your Executives’ Cybersecurity Amidst Global Cyberwar
The importance of protecting executives' personal digital lives during cyberwar. Read more to learn about five safeguards to protect executives and the company.
❌ ‘CatalanGate’ Spyware Infections Tied to NSO Group ❌
📖 Read
via "Threat Post".
Citizen Lab uncovers multi-year campaign targeting autonomous region of Spain, called Catalonia.📖 Read
via "Threat Post".
Threat Post
‘CatalanGate’ Spyware Infections Tied to NSO Group
Citizen Lab uncovers multi-year campaign targeting autonomous region of Spain, called Catalonia.
‼ CVE-2022-29315 ‼
📖 Read
via "National Vulnerability Database".
Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.📖 Read
via "National Vulnerability Database".
❌ Rethinking Cyber-Defense Strategies in the Public-Cloud Age ❌
📖 Read
via "Threat Post".
Exploring what's next for public-cloud security, including top risks and how to implement better risk management.📖 Read
via "Threat Post".
Threat Post
Rethinking Cyber-Defense Strategies in the Public-Cloud Age
Exploring what's next for public-cloud security, including top risks and how to implement better risk management.
‼ CVE-2021-39072 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 215581.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44519 ‼
📖 Read
via "National Vulnerability Database".
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29153 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Consul and Consul Enterprise through 2022-04-12 allow SSRF.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27055 ‼
📖 Read
via "National Vulnerability Database".
** DISPUTED ** ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27104 ‼
📖 Read
via "National Vulnerability Database".
An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39076 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 215585.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39078 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25648 ‼
📖 Read
via "National Vulnerability Database".
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2021-39033 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 213963.📖 Read
via "National Vulnerability Database".
🗓️ Pegasus mobile spyware used zero-click exploits to snoop on Catalan politicians 🗓️
📖 Read
via "The Daily Swig".
#CatalanGate📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Pegasus mobile spyware used zero-click exploits to snoop on Catalan politicians
#CatalanGate
👍1