🕴 Log4j Attack Surface Remains Massive 🕴
📖 Read
via "Dark Reading".
Four months after the Log4Shell vulnerability was disclosed, most affected open source components remain unpatched, and companies continue to use vulnerable versions of the logging tool.📖 Read
via "Dark Reading".
Dark Reading
Log4j Attack Surface Remains Massive
Four months after the Log4Shell vulnerability was disclosed, most affected open source components remain unpatched, and companies continue to use vulnerable versions of the logging tool.
‼ CVE-2022-26564 ‼
📖 Read
via "National Vulnerability Database".
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27888 ‼
📖 Read
via "National Vulnerability Database".
Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in Fixed in 2.249.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27331 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27332 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service (DoS).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28085 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29700 ‼
📖 Read
via "National Vulnerability Database".
A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41041 ‼
📖 Read
via "National Vulnerability Database".
In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29701 ‼
📖 Read
via "National Vulnerability Database".
A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1503 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely but requires authentication. Expoit details have been disclosed within the advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29810 ‼
📖 Read
via "National Vulnerability Database".
The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.📖 Read
via "National Vulnerability Database".
⚠ Phishing goes KISS: Don’t let plain and simple messages catch you out! ⚠
📖 Read
via "Naked Security".
Sometimes we receive phishing tricks that we grudgingly have to admit are better than average, just because they're uncomplicated.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
❌ Millions of Java Apps Remain Vulnerable to Log4Shell ❌
📖 Read
via "Threat Post".
Four months after the critical flaw was discovered, attackers have a massive attack surface from which they can exploit the flaw and take over systems, researchers found.📖 Read
via "Threat Post".
Threat Post
Millions of Java Apps Remain Vulnerable to Log4Shell
Four months after the critical flaw was discovered, attackers have a massive attack surface from which they can exploit the flaw and take over systems, researchers found.
‼ CVE-2022-1504 ‼
📖 Read
via "National Vulnerability Database".
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46441 ‼
📖 Read
via "National Vulnerability Database".
In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system commands after obtaining authorization.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46442 ‼
📖 Read
via "National Vulnerability Database".
In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46421 ‼
📖 Read
via "National Vulnerability Database".
Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, which allows an attacker to obtain sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46420 ‼
📖 Read
via "National Vulnerability Database".
Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability, which allows an attacker to obtain sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46423 ‼
📖 Read
via "National Vulnerability Database".
Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46422 ‼
📖 Read
via "National Vulnerability Database".
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46424 ‼
📖 Read
via "National Vulnerability Database".
Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.📖 Read
via "National Vulnerability Database".