‼ CVE-2022-29943 ‼
📖 Read
via "National Vulnerability Database".
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1584 ‼
📖 Read
via "National Vulnerability Database".
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29942 ‼
📖 Read
via "National Vulnerability Database".
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-25786 ‼
📖 Read
via "National Vulnerability Database".
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.📖 Read
via "National Vulnerability Database".
🕴 GitHub to Developers: Turn on 2FA, or Lose Access 🕴
📖 Read
via "Dark Reading".
All active GitHub users who contribute code will be required to enable at least one form of two-factor authentication by the end of 2023.📖 Read
via "Dark Reading".
Dark Reading
GitHub to Developers: Turn on 2FA or Lose Access
All active GitHub users who contribute code will be required to enable at least one form of two-factor authentication by the end of 2023.
‼ CVE-2022-30292 ‼
📖 Read
via "National Vulnerability Database".
thread_call in sqbaselib.cpp in SQUIRREL 3.2 lacks a certain sq_reservestack call.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30284 ‼
📖 Read
via "National Vulnerability Database".
In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments).📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-30288 ‼
📖 Read
via "National Vulnerability Database".
Agoo through 2.14.2 does not reject GraphQL fragment spreads that form cycles, leading to an application crash.📖 Read
via "National Vulnerability Database".
⚠ Android monthly updates are out – critical bugs found in critical places! ⚠
📖 Read
via "Naked Security".
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...📖 Read
via "Naked Security".
Naked Security
Android monthly updates are out – critical bugs found in critical places!
Android May 2022 updates are out – with some critical fixes in some critical places. Learn more…
⚠ World Password Day – the 1960s just called and gave you your passwords back ⚠
📖 Read
via "Naked Security".
Yes, passwords are going away. No, it won't happen tomorrow. So it's still worth knowing the basics of picking proper passwords.📖 Read
via "Naked Security".
Naked Security
World Password Day – the 1960s just called and gave you your passwords back
Yes, passwords are going away. No, it won’t happen tomorrow. So it’s still worth knowing the basics of picking proper passwords.
🗓️ Serious Snipe-IT bug exploitable to send password reset email traps 🗓️
📖 Read
via "The Daily Swig".
Attackers could use the flaw to steal credentials with no authentication required📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Serious Snipe-IT bug exploitable to send password reset email traps
Attackers could use the flaw to steal credentials with no authentication required
‼ CVE-2022-1588 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) in GitHub repository contao/contao prior to 4.13.3. Attacker can execute Malicious JS in Application :)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28890 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.📖 Read
via "National Vulnerability Database".
🗓️ India to introduce six-hour data breach notification rule 🗓️
📖 Read
via "The Daily Swig".
Reporting window is 66 hours shorter than that stipulated under the EU’s GDPR📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
India to introduce six-hour data breach notification rule
Reporting window is 66 hours shorter than that stipulated under the EU’s GDPR
❌ VHD Ransomware Linked to North Korea’s Lazarus Group ❌
📖 Read
via "Threat Post".
Source code and Bitcoin transactions point to the malware, which emerged in March 2020, being the work of APT38, researchers at Trellix said.📖 Read
via "Threat Post".
Threat Post
VHD Ransomware Linked to North Korea’s Lazarus Group
Source code and Bitcoin transactions point to the malware, which emerged in March 2020, being the work of APT38, researchers at Trellix said.
‼ CVE-2021-41739 ‼
📖 Read
via "National Vulnerability Database".
A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1592 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1411 ‼
📖 Read
via "National Vulnerability Database".
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1590 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45783 ‼
📖 Read
via "National Vulnerability Database".
Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information.📖 Read
via "National Vulnerability Database".
❌ F5 Warns of Critical Bug Allowing Remote Code Execution in BIG-IP Systems ❌
📖 Read
via "Threat Post".
The vulnerability is 'critical' with a CVSS severity rating of 9.8 out of 10.📖 Read
via "Threat Post".
Threat Post
F5 Warns of Critical Bug Allowing Remote Code Execution in BIG-IP Systems
The vulnerability is 'critical' with a CVSS severity rating of 9.8 out of 10.