‼ CVE-2022-23802 ‼
📖 Read
via "National Vulnerability Database".
Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components, possibility to view other users' information.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27766 ‼
📖 Read
via "National Vulnerability Database".
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24098 ‼
📖 Read
via "National Vulnerability Database".
Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input validation vulnerability when parsing a PCX file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PCX file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27764 ‼
📖 Read
via "National Vulnerability Database".
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27759 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27761 ‼
📖 Read
via "National Vulnerability Database".
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2019-12254 ‼
📖 Read
via "National Vulnerability Database".
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25324 ‼
📖 Read
via "National Vulnerability Database".
All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23592 ‼
📖 Read
via "National Vulnerability Database".
The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23792 ‼
📖 Read
via "National Vulnerability Database".
The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30334 ‼
📖 Read
via "National Vulnerability Database".
Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises "Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser."📖 Read
via "National Vulnerability Database".
👍2
♟️ Your Phone May Soon Replace Many of Your Passwords ♟️
📖 Read
via "Krebs on Security".
Apple, Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and ease the overall password burden on Internet users, but caution that a true passwordless future may still be years away for most websites.📖 Read
via "Krebs on Security".
Krebs on Security
Your Phone May Soon Replace Many of Your Passwords
Apple, Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the…
👍2
‼ CVE-2022-1616 ‼
📖 Read
via "National Vulnerability Database".
Use after free in append_command in GitHub repository vim/vim prior to 8.2. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution📖 Read
via "National Vulnerability Database".
🔏 Friday Five 5/6 🔏
📖 Read
via "".
Read up on how passwords may soon be a thing of the past, how your mental health data may be at risk, how business email compromise cost organizations billions in the past five years, and much more—all in this week’s Friday Five!
📖 Read
via "".
🤯1
‼ CVE-2022-30333 ‼
📖 Read
via "National Vulnerability Database".
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23066 ‼
📖 Read
via "National Vulnerability Database".
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.📖 Read
via "National Vulnerability Database".
❌ Podcast: The State of the Secret Sprawl ❌
📖 Read
via "Threat Post".
In this podcast with Mackenzie Jackson, developer advocate at GitGuardian, we dive into the report and also the issues that corporations face with public leaks from groups like Lapsus and more, as well as ways that developers can keep their code safe.📖 Read
via "Threat Post".
Threat Post
The State of Secrets Sprawl – Podcast
In this podcast with Mackenzie Jackson, developer advocate at GitGuardian, we dive into the report and also the issues that corporations face with public leaks from groups like Lapsus and more, as well as ways that developers can keep their code safe.
🗓️ BIG-IP: Proof-of-concept released for RCE vulnerability in F5 network management tool 🗓️
📖 Read
via "The Daily Swig".
Users should patch immediately📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
BIG-IP: Proof-of-concept released for RCE vulnerability in F5 network management tool
Users should patch immediately
🤯1
🗓️ Quantum leap: Biden administration commits to ensuring US leadership in emerging tech 🗓️
📖 Read
via "The Daily Swig".
Government sets out plan for post-quantum encryption📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Quantum leap: Biden administration commits to ensuring US leadership in emerging tech
Government sets out plan for post-quantum encryption
🕴 Security Stuff Happens: Where Do You Go From Here? 🕴
📖 Read
via "Dark Reading".
Despite what it may feel like when you're in the trenches after a security incident, the world doesn't stop moving. (Part 3 of a series.)📖 Read
via "Dark Reading".
Darkreading
Security Stuff Happens: Where Do You Go From Here?
Despite what it may feel like when you're in the trenches after a security incident, the world doesn't stop moving. (Part 3 of a series.)
‼ CVE-2022-30286 ‼
📖 Read
via "National Vulnerability Database".
pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.📖 Read
via "National Vulnerability Database".