‼ CVE-2022-23139 ‼
📖 Read
via "National Vulnerability Database".
ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could actually obtain higher operating permissions on key files.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22986 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22970 ‼
📖 Read
via "National Vulnerability Database".
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27498 ‼
📖 Read
via "National Vulnerability Database".
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22796 ‼
📖 Read
via "National Vulnerability Database".
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23166 ‼
📖 Read
via "National Vulnerability Database".
Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22797 ‼
📖 Read
via "National Vulnerability Database".
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22985 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27478 ‼
📖 Read
via "National Vulnerability Database".
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23742 ‼
📖 Read
via "National Vulnerability Database".
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27482 ‼
📖 Read
via "National Vulnerability Database".
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.📖 Read
via "National Vulnerability Database".
🕴 Transforming SQL Queries Bypasses WAF Security 🕴
📖 Read
via "Dark Reading".
A team of university researchers finds a machine learning-based approach to generating HTTP requests that slip past Web application firewalls.📖 Read
via "Dark Reading".
Dark Reading
Transforming SQL Queries Bypasses WAF Security
A team of university researchers finds a machine learning-based approach to generating HTTP requests that slip past Web application firewalls.
🕴 Black Hat Asia: Firmware Supply-Chain Woes Plague Device Security 🕴
📖 Read
via "Dark Reading".
The supply chain for firmware development is vast, convoluted, and growing out of control: patching security vulnerabilities can take up to two years. For cybercriminals, it's a veritable playground.📖 Read
via "Dark Reading".
Dark Reading
Black Hat Asia: Firmware Supply Chain Woes Plague Device Security
The supply chain for firmware development is vast, convoluted, and growing out of control: patching security vulnerabilities can take up to two years. For cybercriminals, it's a veritable playground.
‼ CVE-2022-29218 ‼
📖 Read
via "National Vulnerability Database".
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27134 ‼
📖 Read
via "National Vulnerability Database".
EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryptocurrency without paying ticket fee via the `std::string memo` parameter.📖 Read
via "National Vulnerability Database".
📢 Data for 120 army recruits found on the dark web 📢
📖 Read
via "ITPro".
The website, run jointly with Capita, has been offline since mid-March as MoD assesses the scope of the breach📖 Read
via "ITPro".
IT PRO
Data for 120 army recruits found on the dark web | IT PRO
The website, run jointly with Capita, has been offline since mid-March as MoD assesses the scope of the breach
📢 Millions of Lenovo laptops thought to be vulnerable to newly discovered UEFI malware attacks 📢
📖 Read
via "ITPro".
ESET researchers said the core vulnerabilities were 'easy' to spot due to "unfortunate" and "honest" driver names📖 Read
via "ITPro".
IT PRO
Millions of Lenovo laptops thought to be vulnerable to newly discovered UEFI malware attacks | IT PRO
ESET researchers said the core vulnerabilities were 'easy' to spot due to "unfortunate" and "honest" driver names
📢 Encryption battle plays out in Australian Parliament 📢
📖 Read
via "ITPro".
The opposition said that the government is “addicted to secrecy”📖 Read
via "ITPro".
IT PRO
Encryption battle plays out in Australian Parliament | IT PRO
The opposition said that the government is “addicted to secrecy”
📢 Datadog's ASM platform unmasks attack flows at code level 📢
📖 Read
via "ITPro".
The service employs distributed tracing to identify cyber criminals📖 Read
via "ITPro".
IT PRO
Datadog's ASM platform unmasks attack flows at code level | IT PRO
The service employs distributed tracing to identify cyber criminals
📢 Ransomware demands in Japan are almost 26 times higher than in the UK, report finds 📢
📖 Read
via "ITPro".
Ransom demands tend to be lower in order to make it easier for organisations to pay them, according to Sophos researchers📖 Read
via "ITPro".
IT PRO
Ransomware demands in Japan are almost 26 times higher than in the UK, report finds | IT PRO
Ransom demands tend to be lower in order to make it easier for organisations to pay them, according to Sophos researchers
📢 The truth about cyber security training 📢
📖 Read
via "ITPro".
Stop ticking boxes. Start delivering real change.📖 Read
via "ITPro".
IT PRO
The truth about cyber security training
Stop ticking boxes. Start delivering real change.