‼ CVE-2022-1118 ‼
📖 Read
via "National Vulnerability Database".
Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited📖 Read
via "National Vulnerability Database".
♟️ When Your Smart ID Card Reader Comes With Malware ♟️
📖 Read
via "Krebs on Security".
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder's appropriate security level. But many government employees aren't issued an approved card reader device that lets them use these cards at home or remotely, and so turn to low-cost readers they find online. What could go wrong? Here's one example.📖 Read
via "Krebs on Security".
Krebs on Security
When Your Smart ID Card Reader Comes With Malware
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder's appropriate…
🗓️ Facebook account takeover: Researcher scoops $40k bug bounty for chained exploit 🗓️
📖 Read
via "The Daily Swig".
Youssef Sammouda returns with more Facebook hacks – this time leveraging stolen Google authentication tokens to gain access to social media accounts📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Facebook account takeover: Researcher scoops $40k bug bounty for chained exploit
Youssef Sammouda returns with more Facebook hacks – this time leveraging stolen Google authentication tokens to gain access to social media accounts
👍1
‼ CVE-2022-30976 ‼
📖 Read
via "National Vulnerability Database".
GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated by MP4Box.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30975 ‼
📖 Read
via "National Vulnerability Database".
In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41946 ‼
📖 Read
via "National Vulnerability Database".
In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a user cannot delete the rule due to the XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30974 ‼
📖 Read
via "National Vulnerability Database".
compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-25061 ‼
📖 Read
via "National Vulnerability Database".
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.📖 Read
via "National Vulnerability Database".
⚠ Pwn2Own hacking schedule released – Windows and Linux are top targets ⚠
📖 Read
via "Naked Security".
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?📖 Read
via "Naked Security".
Naked Security
Pwn2Own hacking schedule released – Windows and Linux are top targets
What’s better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?
👍1
❌ April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell ❌
📖 Read
via "Threat Post".
Researchers say a GitHub proof-of-concept exploitation of recently announced VMware bugs is being abused by hackers in the wild.📖 Read
via "Threat Post".
Threat Post
April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell
Researchers say a GitHub proof-of-concept exploitation of recently announced VMware bugs is being abused by hackers in the wild.
👍1
🕴 How Threat Actors Are a Click Away From Becoming Quasi-APTs 🕴
📖 Read
via "Dark Reading".
As demonstrated in Ukraine and elsewhere, the battlefield for today's warriors extends to the virtual realm with cyber warfare.📖 Read
via "Dark Reading".
Dark Reading
How Threat Actors Are a Click Away From Becoming Quasi-APTs
As demonstrated in Ukraine and elsewhere, the battlefield for today's warriors extends to the virtual realm with cyber warfare.
‼ CVE-2022-29643 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function setMacQos. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28956 ‼
📖 Read
via "National Vulnerability Database".
An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29645 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28955 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29638 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29644 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29641 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29640 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28958 ‼
📖 Read
via "National Vulnerability Database".
D-Link DIR816L_FW206b01 was discovered to contain a remote code execution (RCE) vulnerability via the value parameter at shareport.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29646 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.📖 Read
via "National Vulnerability Database".