‼ CVE-2022-1587 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23657 ‼
📖 Read
via "National Vulnerability Database".
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23670 ‼
📖 Read
via "National Vulnerability Database".
A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23666 ‼
📖 Read
via "National Vulnerability Database".
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.📖 Read
via "National Vulnerability Database".
⚠ Apple patches zero-day kernel hole and much more – update now! ⚠
📖 Read
via "Naked Security".
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-1753 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument group_id allows posting messages in other groups. It is possible to launch the attack remotely but it might require authentication. A video explaining the attack has been disclosed to the public.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1723 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2013-10001 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26650 ‼
📖 Read
via "National Vulnerability Database".
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.📖 Read
via "National Vulnerability Database".
🗓️ Firefox debuts improved process isolation to reduce browser attack surface 🗓️
📖 Read
via "The Daily Swig".
The goal was Win32k Lockdown – a serious step up in Windows security📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Firefox debuts improved process isolation to reduce browser attack surface
The goal was Win32k Lockdown – a serious step up in Windows security
❌ iPhones Vulnerable to Attack Even When Turned Off ❌
📖 Read
via "Threat Post".
Wireless features Bluetooth, NFC and UWB stay on even when the device is powered down, which could allow attackers to execute pre-loaded malware.📖 Read
via "Threat Post".
Threat Post
iPhones Vulnerable to Attack Even When Turned Off
Wireless features Bluetooth, NFC and UWB stay on even when the device is powered down, which could allow attackers to execute pre-loaded malware.
❌ Sysrv-K Botnet Targets Windows, Linux ❌
📖 Read
via "Threat Post".
Microsoft researchers say they are tracking a botnet that is leveraging bugs in the Spring Framework and WordPress plugins.📖 Read
via "Threat Post".
Threat Post
Sysrv-K Botnet Targets Windows, Linux
Microsoft researchers say they are tracking a botnet that is leveraging bugs in the Spring Framework and WordPress plugins.
‼ CVE-2022-1711 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42643 ‼
📖 Read
via "National Vulnerability Database".
cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42644 ‼
📖 Read
via "National Vulnerability Database".
cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.📖 Read
via "National Vulnerability Database".
🗓️ Medical doctor charged with creating the Thanos ransomware builder 🗓️
📖 Read
via "The Daily Swig".
Venezuelan cardiologist allegedly tied to cybercrime scams through multiple OpSec mistakes📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Medical doctor charged with creating the Thanos ransomware builder
Venezuelan cardiologist allegedly tied to cybercrime scams through multiple OpSec mistakes
🗓️ ‘Eternity malware’ offers Swiss Army knife of cybercrime tools 🗓️
📖 Read
via "The Daily Swig".
A one-stop shop for data and crypto kleptomaniacs📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
‘Eternity malware’ offers Swiss Army knife of cybercrime tools
A one-stop shop for data and crypto kleptomaniacs
‼ CVE-2022-30970 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30961 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30951 ‼
📖 Read
via "National Vulnerability Database".
Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30963 ‼
📖 Read
via "National Vulnerability Database".
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.📖 Read
via "National Vulnerability Database".