‼ CVE-2022-20796 ‼
📖 Read
via "National Vulnerability Database".
On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20734 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23443 ‼
📖 Read
via "National Vulnerability Database".
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20770 ‼
📖 Read
via "National Vulnerability Database".
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.📖 Read
via "National Vulnerability Database".
🔏 What Is the Defense Federal Acquisition Regulation Supplement (DFARS)? 🔏
📖 Read
via "".
Learn more about what DFARS compliance means, who and what it applies to, and what the minimum requirements are for organizations to comply.📖 Read
via "".
Digital Guardian
What Is the Defense Federal Acquisition Regulation Supplement (DFARS)?
Learn more about what DFARS compliance means, who and what it applies to, and what the minimum requirements are for organizations to comply.
🕴 Q&A: How China Is Exporting Tech-Based Authoritarianism Across the World 🕴
📖 Read
via "Dark Reading".
The US has to adapt its own policies to counter the push, warns former DocuSign CEO and Under Secretary of State Keith Krach.📖 Read
via "Dark Reading".
Dark Reading
Q&A: How China Is Exporting Tech-Based Authoritarianism Across the World
The US has to adapt its own policies to counter the push, warns former DocuSign CEO and Under Secretary of State Keith Krach.
🕴 Microsoft Releases Defender for SMBs 🕴
📖 Read
via "Dark Reading".
Microsoft's stand-alone version of Defender for SMBs promises to help SecOps teams automate detection, response, and recovery.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Releases Defender for SMBs
Microsoft's stand-alone version of Defender for SMBs promises to help SecOps teams automate detection, response, and recovery.
🕴 China-Backed Winnti APT Siphons Reams of US Trade Secrets in Sprawling Cyber-Espionage Attack 🕴
📖 Read
via "Dark Reading".
Operation CuckooBees uncovered the state-sponsored group's sophisticated new tactics in a years-long campaign that hit more than 30 tech and manufacturing companies.📖 Read
via "Dark Reading".
Dark Reading
China-Backed Winnti APT Siphons Reams of US Trade Secrets in Sprawling Cyber-Espionage Attack
Operation CuckooBees uncovered the state-sponsored group's sophisticated new tactics in a years-long campaign that hit more than 30 tech and manufacturing companies.
‼ CVE-2022-30241 ‼
📖 Read
via "National Vulnerability Database".
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29943 ‼
📖 Read
via "National Vulnerability Database".
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1584 ‼
📖 Read
via "National Vulnerability Database".
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29942 ‼
📖 Read
via "National Vulnerability Database".
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-25786 ‼
📖 Read
via "National Vulnerability Database".
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.📖 Read
via "National Vulnerability Database".
🕴 GitHub to Developers: Turn on 2FA, or Lose Access 🕴
📖 Read
via "Dark Reading".
All active GitHub users who contribute code will be required to enable at least one form of two-factor authentication by the end of 2023.📖 Read
via "Dark Reading".
Dark Reading
GitHub to Developers: Turn on 2FA or Lose Access
All active GitHub users who contribute code will be required to enable at least one form of two-factor authentication by the end of 2023.
‼ CVE-2022-30292 ‼
📖 Read
via "National Vulnerability Database".
thread_call in sqbaselib.cpp in SQUIRREL 3.2 lacks a certain sq_reservestack call.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30284 ‼
📖 Read
via "National Vulnerability Database".
In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments).📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-30288 ‼
📖 Read
via "National Vulnerability Database".
Agoo through 2.14.2 does not reject GraphQL fragment spreads that form cycles, leading to an application crash.📖 Read
via "National Vulnerability Database".
⚠ Android monthly updates are out – critical bugs found in critical places! ⚠
📖 Read
via "Naked Security".
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...📖 Read
via "Naked Security".
Naked Security
Android monthly updates are out – critical bugs found in critical places!
Android May 2022 updates are out – with some critical fixes in some critical places. Learn more…
⚠ World Password Day – the 1960s just called and gave you your passwords back ⚠
📖 Read
via "Naked Security".
Yes, passwords are going away. No, it won't happen tomorrow. So it's still worth knowing the basics of picking proper passwords.📖 Read
via "Naked Security".
Naked Security
World Password Day – the 1960s just called and gave you your passwords back
Yes, passwords are going away. No, it won’t happen tomorrow. So it’s still worth knowing the basics of picking proper passwords.
🗓️ Serious Snipe-IT bug exploitable to send password reset email traps 🗓️
📖 Read
via "The Daily Swig".
Attackers could use the flaw to steal credentials with no authentication required📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Serious Snipe-IT bug exploitable to send password reset email traps
Attackers could use the flaw to steal credentials with no authentication required
‼ CVE-2022-1588 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) in GitHub repository contao/contao prior to 4.13.3. Attacker can execute Malicious JS in Application :)📖 Read
via "National Vulnerability Database".