βΌ CVE-2022-22796 βΌ
π Read
via "National Vulnerability Database".
Sysaid Γ’β¬β Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.π Read
via "National Vulnerability Database".
βΌ CVE-2022-23166 βΌ
π Read
via "National Vulnerability Database".
Sysaid Γ’β¬β Sysaid Local File Inclusion (LFI) Γ’β¬β An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.π Read
via "National Vulnerability Database".
βΌ CVE-2022-22797 βΌ
π Read
via "National Vulnerability Database".
Sysaid Γ’β¬β sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.π Read
via "National Vulnerability Database".
βΌ CVE-2020-22985 βΌ
π Read
via "National Vulnerability Database".
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.π Read
via "National Vulnerability Database".
βΌ CVE-2021-27478 βΌ
π Read
via "National Vulnerability Database".
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.π Read
via "National Vulnerability Database".
βΌ CVE-2022-23742 βΌ
π Read
via "National Vulnerability Database".
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.π Read
via "National Vulnerability Database".
βΌ CVE-2021-27482 βΌ
π Read
via "National Vulnerability Database".
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.π Read
via "National Vulnerability Database".
π΄ Transforming SQL Queries Bypasses WAF Security π΄
π Read
via "Dark Reading".
A team of university researchers finds a machine learning-based approach to generating HTTP requests that slip past Web application firewalls.π Read
via "Dark Reading".
Dark Reading
Transforming SQL Queries Bypasses WAF Security
A team of university researchers finds a machine learning-based approach to generating HTTP requests that slip past Web application firewalls.
π΄ Black Hat Asia: Firmware Supply-Chain Woes Plague Device Security π΄
π Read
via "Dark Reading".
The supply chain for firmware development is vast, convoluted, and growing out of control: patching security vulnerabilities can take up to two years. For cybercriminals, it's a veritable playground.π Read
via "Dark Reading".
Dark Reading
Black Hat Asia: Firmware Supply Chain Woes Plague Device Security
The supply chain for firmware development is vast, convoluted, and growing out of control: patching security vulnerabilities can take up to two years. For cybercriminals, it's a veritable playground.
βΌ CVE-2022-29218 βΌ
π Read
via "National Vulnerability Database".
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.π Read
via "National Vulnerability Database".
βΌ CVE-2022-27134 βΌ
π Read
via "National Vulnerability Database".
EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryptocurrency without paying ticket fee via the `std::string memo` parameter.π Read
via "National Vulnerability Database".
π’ Data for 120 army recruits found on the dark web π’
π Read
via "ITPro".
The website, run jointly with Capita, has been offline since mid-March as MoD assesses the scope of the breachπ Read
via "ITPro".
IT PRO
Data for 120 army recruits found on the dark web | IT PRO
The website, run jointly with Capita, has been offline since mid-March as MoD assesses the scope of the breach
π’ Millions of Lenovo laptops thought to be vulnerable to newly discovered UEFI malware attacks π’
π Read
via "ITPro".
ESET researchers said the core vulnerabilities were 'easy' to spot due to "unfortunate" and "honest" driver namesπ Read
via "ITPro".
IT PRO
Millions of Lenovo laptops thought to be vulnerable to newly discovered UEFI malware attacks | IT PRO
ESET researchers said the core vulnerabilities were 'easy' to spot due to "unfortunate" and "honest" driver names
π’ Encryption battle plays out in Australian Parliament π’
π Read
via "ITPro".
The opposition said that the government is βaddicted to secrecyβπ Read
via "ITPro".
IT PRO
Encryption battle plays out in Australian Parliament | IT PRO
The opposition said that the government is βaddicted to secrecyβ
π’ Datadog's ASM platform unmasks attack flows at code level π’
π Read
via "ITPro".
The service employs distributed tracing to identify cyber criminalsπ Read
via "ITPro".
IT PRO
Datadog's ASM platform unmasks attack flows at code level | IT PRO
The service employs distributed tracing to identify cyber criminals
π’ Ransomware demands in Japan are almost 26 times higher than in the UK, report finds π’
π Read
via "ITPro".
Ransom demands tend to be lower in order to make it easier for organisations to pay them, according to Sophos researchersπ Read
via "ITPro".
IT PRO
Ransomware demands in Japan are almost 26 times higher than in the UK, report finds | IT PRO
Ransom demands tend to be lower in order to make it easier for organisations to pay them, according to Sophos researchers
π’ The truth about cyber security training π’
π Read
via "ITPro".
Stop ticking boxes. Start delivering real change.π Read
via "ITPro".
IT PRO
The truth about cyber security training
Stop ticking boxes. Start delivering real change.
π’ Microsoft's latest VPN-like feature brings added network privacy to Edge users π’
π Read
via "ITPro".
The Microsoft Edge Secure Network feature is currently available in preview and offers similar data privacy protections to Apple's Private Relay toolπ Read
via "ITPro".
ITPro
Microsoft's latest VPN-like feature brings added network privacy to Edge users
The Microsoft Edge Secure Network feature is currently available in preview and offers similar data privacy protections to Apple's Private Relay tool
π’ Microsoft announces lucrative new bug bounty awards for M365 products and services π’
π Read
via "ITPro".
The new awards will focus on scenario-based weaknesses and offer bonuses of up to 30% for the most severe bugsπ Read
via "ITPro".
ITPro
Microsoft announces lucrative new bug bounty awards for M365 products and services
The new awards will focus on scenario-based weaknesses and offer bonuses of up to 30% for the most severe bugs
π’ How cyber security history repeats itself π’
π Read
via "ITPro".
The prime threats to businesses continue to be the same threats weβve seen for the past decade β and if your business isnβt prepared, you might be at legal riskπ Read
via "ITPro".
ITPro
How cyber security history repeats itself
The prime threats to businesses continue to be the same threats weβve seen for the past decade β and if your business isnβt prepared, you might be at legal risk
π’ The state of brand protection 2021 π’
π Read
via "ITPro".
A new front opens up in the war for brand safetyπ Read
via "ITPro".
IT PRO
The state of brand protection 2021
A new front opens up in the war for brand safety