‼ CVE-2022-1014 ‼
📖 Read
via "National Vulnerability Database".
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0346 ‼
📖 Read
via "National Vulnerability Database".
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1093 ‼
📖 Read
via "National Vulnerability Database".
The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-0781 ‼
📖 Read
via "National Vulnerability Database".
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1192 ‼
📖 Read
via "National Vulnerability Database".
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42586 ‼
📖 Read
via "National Vulnerability Database".
A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29599 ‼
📖 Read
via "National Vulnerability Database".
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1825 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42585 ‼
📖 Read
via "National Vulnerability Database".
A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28874 ‼
📖 Read
via "National Vulnerability Database".
Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause memory corruption and heap buffer overflow which eventually can crash the scanning engine. The exploit can be triggered remotely by an attacker.📖 Read
via "National Vulnerability Database".
❌ Zero Trust for Data Helps Enterprises Detect, Respond and Recover from Breaches ❌
📖 Read
via "Threat Post".
Mohit Tiwari, CEO of Symmetry Systems, explores Zero Trust, data objects and the NIST framework for cloud and on-prem environments.📖 Read
via "Threat Post".
Threat Post
Zero Trust for Data Helps Enterprises Detect, Respond and Recover from Breaches
Mohit Tiwari, CEO of Symmetry Systems, explores Zero Trust, data objects and the NIST framework for cloud and on-prem environments.
⚠ Clearview AI face-matching service fined a lot less than expected ⚠
📖 Read
via "Naked Security".
The fine has finally gone through... but it's less than 45% of what was originally proposed.📖 Read
via "Naked Security".
Naked Security
Clearview AI face-matching service fined a lot less than expected
The fine has finally gone through… but it’s less than 45% of what was originally proposed.
🗓️ Blockchain bridge Wormhole pays record $10m bug bounty reward 🗓️
📖 Read
via "The Daily Swig".
Critical security flaw patched on the same day it was submitted📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Blockchain bridge Wormhole pays record $10m bug bounty reward
Critical security flaw patched on the same day it was submitted
🕴 After the Okta Breach, Diversify Your Sources of Truth 🕴
📖 Read
via "Dark Reading".
What subsequent protections do you have in place when your first line of defense goes down?📖 Read
via "Dark Reading".
Dark Reading
After the Okta Breach, Diversify Your Sources of Truth
What subsequent protections do you have in place when your first line of defense goes down?
🗓️ Yik Yak fixes information disclosure bug that leaked users’ GPS location 🗓️
📖 Read
via "The Daily Swig".
Hairy MitM exploit independently discovered by two security researchers📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Yik Yak fixes information disclosure bug that leaked users’ GPS location
Hairy MitM exploit independently discovered by two security researchers
‼ CVE-2022-1817 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the userlist module at /bcms/admin/?page=user/list. The manipulation of the argument username with the input </td><img src="" onerror="alert(1)"><td>1 leads to an authenticated cross site scripting. Exploit details have been disclosed to the public.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1816 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issue is /zoo/admin/public_html/view_accounts?type=zookeeper of the content module. The manipulation of the argument admin_name with the input <script>alert(1)</script> leads to an authenticated cross site scripting. Exploit details have been disclosed to the public.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1810 ‼
📖 Read
via "National Vulnerability Database".
Improper Access Control in GitHub repository publify/publify prior to 9.2.9.📖 Read
via "National Vulnerability Database".
🕴 Valeo Networks Acquires Next I.T. 🕴
📖 Read
via "Dark Reading".
Next I.T. is the sixth and largest acquisition to date for Valeo Networks.📖 Read
via "Dark Reading".
Dark Reading
Valeo Networks Acquires Next I.T.
Next I.T. is the sixth and largest acquisition to date for Valeo Networks.
🕴 Kingston Digital Releases Touch-Screen Hardware-Encrypted External SSD for Data Protection 🕴
📖 Read
via "Dark Reading".
IronKey Vault Privacy 80 External SSD safeguards against brute-force attacks and BadUSB with digitally-signed firmware.📖 Read
via "Dark Reading".
Dark Reading
Kingston Digital Releases Touch-Screen Hardware-Encrypted External SSD for Data Protection
IronKey Vault Privacy 80 External SSD safeguards against brute-force attacks and BadUSB with digitally-signed firmware.
🗓️ Chicago Public Schools data breach blamed on ransomware attack on supplier 🗓️
📖 Read
via "The Daily Swig".
Cybercrooks compromised server containing student course information and assessment data📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Chicago Public Schools data breach blamed on third-party ransomware attack
Cybercrooks compromised server containing student course information and assessment data