‼ CVE-2020-14123 ‼
📖 Read
via "National Vulnerability Database".
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29824 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38946 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38905 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20464 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38904 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1439 ‼
📖 Read
via "National Vulnerability Database".
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38886 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38903 ‼
📖 Read
via "National Vulnerability Database".
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29582 ‼
📖 Read
via "National Vulnerability Database".
In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29583 ‼
📖 Read
via "National Vulnerability Database".
service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29589 ‼
📖 Read
via "National Vulnerability Database".
Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username.📖 Read
via "National Vulnerability Database".
👍1
🕴 Early Discovery of Pipedream Malware a Success Story for Industrial Security 🕴
📖 Read
via "Dark Reading".
Cybersecurity professionals discovered, analyzed, and created defenses against the ICS malware framework before it was deployed, but expect the stakes to keep rising.📖 Read
via "Dark Reading".
Dark Reading
Early Discovery of Pipedream Malware a Success Story for Industrial Security
Cybersecurity professionals discovered, analyzed, and created defenses against the ICS malware framework before it was deployed, but expect the stakes to keep rising.
🕴 FBI Warns Ransomware Attacks on Agriculture Co-ops Could Upend Food Supply Chain 🕴
📖 Read
via "Dark Reading".
Ransomware groups are looking to strike large agriculture cooperatives during strategic seasons, when they are most vulnerable, according to law enforcement.📖 Read
via "Dark Reading".
Dark Reading
FBI Warns Ransomware Attacks on Agriculture Co-ops Could Upend Food Supply Chain
Ransomware groups are looking to strike large agriculture cooperatives during strategic seasons, when they are most vulnerable, according to law enforcement.
🕴 Neustar Security Services’ UltraDNS Integrates Terraform for Streamlined, Automated DNS Management 🕴
📖 Read
via "Dark Reading".
UltraDNS Terraform Provider enhances productivity, change management.📖 Read
via "Dark Reading".
Dark Reading
Neustar Security Services’ UltraDNS Integrates Terraform for Streamlined, Automated DNS Management
UltraDNS Terraform Provider enhances productivity, change management.
‼ CVE-2022-1440 ‼
📖 Read
via "National Vulnerability Database".
Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.📖 Read
via "National Vulnerability Database".
🕴 Sophos Buys Alert-Monitoring Automation Vendor 🕴
📖 Read
via "Dark Reading".
Acquisition of cloud-based alert security company will help Sophos automate tasks bogging down security teams, the company says.📖 Read
via "Dark Reading".
Dark Reading
Sophos Buys Alert-Monitoring Automation Vendor
Acquisition of cloud-based alert security company will help Sophos automate tasks bogging down security teams, the company says.
👍1
‼ CVE-2021-3971 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27340 ‼
📖 Read
via "National Vulnerability Database".
MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1108 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0636 ‼
📖 Read
via "National Vulnerability Database".
A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash.📖 Read
via "National Vulnerability Database".