πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-30700 β€Ό

An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1909 β€Ό

Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1907 β€Ό

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1908 β€Ό

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1898 β€Ό

Use After Free in GitHub repository vim/vim prior to 8.2.

πŸ“– Read

via "National Vulnerability Database".
❌ Critical Flaws in Popular ICS Platform Can Trigger RCE ❌

Cisco Talos discovered eight vulnerabilities in the Open Automation Software, two of them critical, that pose risk for critical infrastructure networks.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Security β€˜researcher’ hits back against claims of malicious CTX file uploads πŸ—“οΈ

They claim that all data received was deleted

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Taking the Danger Out of IT/OT Convergence πŸ•΄

The Colonial Pipeline attack highlighted the dangers of convergence, but unified security provides a safer way to proceed.

πŸ“– Read

via "Dark Reading".
⚠ S3 Ep84: Government demand, Mozilla velocity, and Clearview fine [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
πŸ—“οΈ Patch released for cross-domain cookie leakage flaw in Guzzle πŸ—“οΈ

Drupal rolls out update for issue that is contingent on cookie middleware being enabled

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Physical Security Teams' Impact Is Far-Reaching πŸ•΄

Here's how physical security teams can integrate with the business to identify better solutions to security problems.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ” Friday Five 5/27 πŸ”

Learn why Twitter owes the Federal Trade Commission $150 million, how spyware is taking advantage of zero-day vulnerabilities, and more in this week's Friday Five!


πŸ“– Read

via "".
πŸ•΄ ChromeLoader Malware Hijacks Browsers With ISO Files πŸ•΄

The malware’s abuse of PowerShell makes it more dangerous, allowing for more advanced attacks such as ransomware, fileless malware, and malicious code memory injections.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-20668 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20671 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20765 β€Ό

A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom JavaScript to affected web applications. A successful exploit could allow the attacker to rewrite web page content, access sensitive information stored in the applications, and alter data by submitting forms.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20672 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20807 β€Ό

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20797 β€Ό

A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated, remote attacker to execute arbitrary commands as an administrator on the underlying operating system. This vulnerability is due to insufficient user input validation by the web-based management interface of the affected software. An attacker could exploit this vulnerability by injecting arbitrary commands in the web-based management interface. A successful exploit could allow the attacker to make configuration changes on the affected device or cause certain services to restart unexpectedly.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20802 β€Ό

A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to execute arbitrary code in the context of the interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20670 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".