‼ CVE-2022-20802 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to execute arbitrary code in the context of the interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20670 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20674 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20673 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20666 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20806 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1897 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20667 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20669 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
🕴 New Chaos Malware Variant Ditches Wiper for Encryption 🕴
📖 Read
via "Dark Reading".
The Chaos ransomware-builder was known for creating destructor malware that overwrote files and made them unrecoverable -- but the new Yashma version finally generates binaries that can encrypt files of all sizes.📖 Read
via "Dark Reading".
Dark Reading
New Chaos Malware Variant Ditches Wiper for Encryption
The Chaos ransomware-builder was known for creating destructor malware that overwrote files and made them unrecoverable -- but the new Yashma version finally generates binaries that can encrypt files of all sizes.
👍1
🕴 Scammer Behind $568M International Cybercrime Syndicate Gets 4 Years 🕴
📖 Read
via "Dark Reading".
The 14th defendant behind The Infraud Organization contraband marketplace has been sentenced, this time for one count of racketeering.📖 Read
via "Dark Reading".
Dark Reading
Scammer Behind $568M International Cybercrime Syndicate Gets 4 Years
The 14th defendant behind The Infraud Organization contraband marketplace has been sentenced, this time for one count of racketeering.
‼ CVE-2021-27780 ‼
📖 Read
via "National Vulnerability Database".
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27781 ‼
📖 Read
via "National Vulnerability Database".
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.📖 Read
via "National Vulnerability Database".
🕴 Space Force Expands Cyber Defense Operations 🕴
📖 Read
via "Dark Reading".
Space Force's Delta 6 cyber-defense group adds squadrons, updates legacy Satellite Control Network.📖 Read
via "Dark Reading".
Dark Reading
Space Force Expands Cyber Defense Operations
Space Force's Delta 6 cyber-defense group adds squadrons, updates legacy Satellite Control Network.
🕴 Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 🕴
📖 Read
via "Dark Reading".
Organizations must ensure their kubelets and related APIs aren’t inadvertently exposed or lack proper access control, offering an easy access point for malicious actors.📖 Read
via "Dark Reading".
Dark Reading
Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks
Organizations must ensure their kubelets and related APIs aren’t inadvertently exposed or lack proper access control, offering an easy access point for malicious actors.
‼ CVE-2022-25878 ‼
📖 Read
via "National Vulnerability Database".
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files📖 Read
via "National Vulnerability Database".
📢 AVG AntiVirus Free review: Great malware protection, though the upsell is a turn-off 📢
📖 Read
via "ITPro".
AVG serves up the same powerful antivirus engine as Avast, but the trimmings aren’t as generous📖 Read
via "ITPro".
IT PRO
AVG AntiVirus Free review: Great malware protection, though the upsell is a turn-off | IT PRO
AVG serves up the same powerful antivirus engine as Avast, but the trimmings aren’t as generous
📢 What is hacktivism? 📢
📖 Read
via "ITPro".
From Anonymous to Omega, here’s everything you need to know about hackers with a conscience📖 Read
via "ITPro".
IT PRO
What is hacktivism? | IT PRO
From Anonymous to the IT Army of Ukraine, we answer 'what is hacktivism' and guide you through the history of the most compelling corner of the tech industry
📢 Google adds new security vendor plugins for Chrome, improved Chrome OS policy controls for IT admins 📢
📖 Read
via "ITPro".
New integrations across various security pillars aim to improve Chrome OS and Chrome browser security for enterprise customers📖 Read
via "ITPro".
IT PRO
Google adds new security vendor plugins for Chrome, improved Chrome OS policy controls for IT admins | IT PRO
New integrations across various security pillars aim to improve Chrome OS and Chrome browser security for enterprise customers
📢 Avast One Essential review: A great free antivirus solution with some tempting extra features 📢
📖 Read
via "ITPro".
If Microsoft Defender isn’t doing it for you, Avast has you covered with strong protection in a user-friendly package📖 Read
via "ITPro".
ITPro
Avast One Essential review: A great free antivirus solution with some tempting extra features
If Microsoft Defender isn’t doing it for you, Avast has you covered with strong protection in a user-friendly package
📢 (ISC)2 launches free scheme to get 100,000 UK citizens into cyber security 📢
📖 Read
via "ITPro".
The certification non-profit estimates the UK has around 33,000 cyber security vacancies, with that figure set to rise this year📖 Read
via "ITPro".
IT PRO
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security | IT PRO
The industry body will offer its entry-level cyber security course and exam at no cost for uncertified individuals looking to move into a career in information security