πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-27632 β€Ό

Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operations by having a user to view a specially crafted page.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1727 β€Ό

Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28717 β€Ό

Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker with the administrative privilege to inject an arbitrary script via unspecified vectors.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29516 β€Ό

The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3200, 3500), IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN(2300, 2500, 2700), IPCOM EX LB(1100, 1300, 2300, 2500, 2700), IPCOM EX SC(1100, 1300, 2300, 2500, 2700), and IPCOM EX NW(1100, 1300, 2300, 2500, 2700)) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1430 β€Ό

Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30065 β€Ό

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1782 β€Ό

Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27548 β€Ό

There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Microsoft Flags Attack Targeting SQL Servers With Novel Approach πŸ•΄

Attackers appear to have found a way around PowerShell monitoring by using a default utility instead.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 2022: The Year Zero Trust Becomes Mainstream πŸ•΄

It has never been more important for organizations of all sizes to prioritize securing their users and their infrastructure secrets with zero-trust network access.

πŸ“– Read

via "Dark Reading".
β™ŸοΈ Senators Urge FTC to Probe ID.me Over Selfie Data β™ŸοΈ

Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for "deceptive statements" the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service, which until recently required anyone seeking a new IRS account online to provide a live video selfie to ID.me.

πŸ“– Read

via "Krebs on Security".
πŸ•΄ The Industry Must Better Secure Open Source Code From Threat Actors πŸ•΄

Build security in up front to secure open source code at the foundational level. Apply security controls, have engineering teams test, do code review, and use attacker-centric behavioral analytics to mitigate threats.

πŸ“– Read

via "Dark Reading".
πŸ•΄ CISA: Unpatched F5 BIG-IP Devices Under Active Attack πŸ•΄

Publicly released proof-of-concept exploits are supercharging attacks against unpatched systems, CISA warns.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-3956 β€Ό

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports Ò€œunauthenticated bindҀ�, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only Ò€œauthenticated bindҀ� and/or Ò€œanonymous bindҀ� are not affected.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
β€Ό CVE-2022-0883 β€Ό

SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22786 β€Ό

The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22785 β€Ό

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1767 β€Ό

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1110 β€Ό

A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42852 β€Ό

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28917 β€Ό

Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp.

πŸ“– Read

via "National Vulnerability Database".