‼ CVE-2022-28081 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27903 ‼
📖 Read
via "National Vulnerability Database".
An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remote authenticated attacker to execute commands as root by editing virtualization command parameters of imported UNL files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25784 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting. This issue affects: Secomea SiteManager all versions prior to 9.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28512 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability exists in Sourcecodester Fantastic Blog CMS 1.0 . An attacker can inject query in "/fantasticblog/single.php" via the "id=5" parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28076 ‼
📖 Read
via "National Vulnerability Database".
Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28487 ‼
📖 Read
via "National Vulnerability Database".
Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25787 ‼
📖 Read
via "National Vulnerability Database".
Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. This issue affects: Secomea GateManager all versions prior to 9.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28066 ‼
📖 Read
via "National Vulnerability Database".
Libarchive v3.6.0 was discovered to contain a read memory access vulnerability via the function lzma_decode.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25785 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code execution. This issue affects: Secomea SiteManager all versions prior to 9.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25781 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28067 ‼
📖 Read
via "National Vulnerability Database".
An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a crafted executable.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28488 ‼
📖 Read
via "National Vulnerability Database".
The function wav_format_write in libwav.c in libwav through 2017-04-20 has an Use of Uninitialized Variable vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25783 ‼
📖 Read
via "National Vulnerability Database".
Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28806 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25780 ‼
📖 Read
via "National Vulnerability Database".
Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29950 ‼
📖 Read
via "National Vulnerability Database".
Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subrule name or (3) categories name parameter to the Subrules page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25782 ‼
📖 Read
via "National Vulnerability Database".
Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information. This issue affects: Secomea GateManager versions prior to 9.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28082 ‼
📖 Read
via "National Vulnerability Database".
Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList.📖 Read
via "National Vulnerability Database".
🕴 Security Stuff Happens: What Will the Public Hear When You Say You've Been Breached? 🕴
📖 Read
via "Dark Reading".
A company's response to a breach is more important than almost anything else. But what constitutes a "good" response following a security incident? (Part 2 of a series.)📖 Read
via "Dark Reading".
Darkreading
Security Stuff Happens: What Will the Public Hear When You Say You've Been Breached?
A company's response to a breach is more important than almost anything else. But what constitutes a "good" response following a security incident? (Part 2 of a series.)
🕴 New Ransomware Variant Linked to North Korean Cyber Army 🕴
📖 Read
via "Dark Reading".
Researchers use code, Bitcoin transactions to link ransomware attacks on banks to DPRK-sponsored actors.📖 Read
via "Dark Reading".
Darkreading
VHD Ransomware Variant Linked to North Korean Cyber Army
Researchers use code, Bitcoin transactions to link ransomware attacks on banks to DPRK-sponsored actors.
❌ China-linked APT Caught Pilfering Treasure Trove of IP ❌
📖 Read
via "Threat Post".
A state-sponsored threat actor designed a house-of-cards style infection chain to exfiltrate massive troves of highly sensitive data.📖 Read
via "Threat Post".
Threat Post
China-linked APT Caught Pilfering Treasure Trove of IP
A state-sponsored threat actor designed a house-of-cards style infection chain to exfiltrate massive troves of highly sensitive data.