‼ CVE-2021-27914 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31000 ‼
📖 Read
via "National Vulnerability Database".
solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24848 ‼
📖 Read
via "National Vulnerability Database".
DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the `/api/programs/orgUnits?programs=` API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. The vulnerability is not exposed to a non-malicious user and requires a conscious attack to be exploited. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance's database. Security patches are now available for DHIS2 versions 2.36.10.1 and 2.37.6.1. One may apply mitigations at the web proxy level as a workaround. More information about these mitigations is available in the GitHub Security Advisory.📖 Read
via "National Vulnerability Database".
🕴 EnemyBot Puts Enterprises in the Crosshairs With Raft of '1-Day' Bugs 🕴
📖 Read
via "Dark Reading".
EnemyBot DDoS botnet is rapidly weaponizing security bugs disclosed in CMS systems like WordPress plug-ins, Android devices, commercial Web servers, and other enterprise applications.📖 Read
via "Dark Reading".
Dark Reading
EnemyBot Puts Enterprises in the Crosshairs With Raft of '1-Day' Bugs
EnemyBot DDoS botnet is rapidly weaponizing security bugs disclosed in CMS systems like WordPress plug-ins, Android devices, commercial Web servers, and other enterprise applications.
🕴 Netskope Acquires WootCloud, Extending Zero Trust Capabilities to Enterprise IoT 🕴
📖 Read
via "Dark Reading".
Contextual Intelligence derived with machine learning helps customers identify, assess and remediate threats from IoT devices on their networks, achieving full visibility and control.📖 Read
via "Dark Reading".
Dark Reading
Netskope Acquires WootCloud, Extending Zero Trust Capabilities to Enterprise IoT
Contextual Intelligence derived with machine learning helps customers identify, assess and remediate threats from IoT devices on their networks, achieving full visibility and control.
🕴 Lookout Acquires SaferPass To Address The Rising Threat Of Identity Theft 🕴
📖 Read
via "Dark Reading".
Password management solution delivers proactive, seamless approach to protecting privacy and login credentials for consumers and businesses; Password Management market expected to reach $3 billion by 2026.📖 Read
via "Dark Reading".
Dark Reading
Lookout Acquires SaferPass To Address The Rising Threat Of Identity Theft
Password management solution delivers proactive, seamless approach to protecting privacy and login credentials for consumers and businesses; Password Management market expected to reach $3 billion by 2026.
🕴 ReliaQuest to Acquire Digital Shadows 🕴
📖 Read
via "Dark Reading".
Combined company creates world-class security operations platform to offer customers unmatched visibility and detection to defend against threats.📖 Read
via "Dark Reading".
Dark Reading
ReliaQuest to Acquire Digital Shadows
Combined company creates world-class security operations platform to offer customers unmatched visibility and detection to defend against threats.
🕴 NetSPI's New Breach and Attack Simulation Enhancements Help Organizations Achieve Behavior-Based Threat Detection 🕴
📖 Read
via "Dark Reading".
Organizations leverage the platform-driven, human-delivered service to measure and continuously improve the efficacy of detective controls and MSSP coverage.📖 Read
via "Dark Reading".
Dark Reading
NetSPI's New Breach and Attack Simulation Enhancements Help Organizations Achieve Behavior-Based Threat Detection
Organizations leverage the platform-driven, human-delivered service to measure and continuously improve the efficacy of detective controls and MSSP coverage.
🕴 Netenrich Debuts Resolution Intelligence Secure Digital Operations Platform at RSA 2022 🕴
📖 Read
via "Dark Reading".
New operational analytics and AI/ML platform drives contextual intelligence and prioritized actions to anticipate risky behaviors, disrupt threats and insure business resilience.📖 Read
via "Dark Reading".
Dark Reading
Netenrich Debuts Resolution Intelligence Secure Digital Operations Platform at RSA 2022
New operational analytics and AI/ML platform drives contextual intelligence and prioritized actions to anticipate risky behaviors, disrupt threats and insure business resilience.
🕴 Feds Seize Domains Dealing Stolen Personal Data 🕴
📖 Read
via "Dark Reading".
WeLeakInfo.to and two related domains let users search data stolen in more than 10,000 different breaches.📖 Read
via "Dark Reading".
Dark Reading
Feds Seize Domains Dealing Stolen Personal Data
WeLeakInfo.to and two related domains let users search data stolen in more than 10,000 different breaches.
🕴 Darktrace's David Masson on What Attacks on Critical Infrastructure Look Like 🕴
📖 Read
via "Dark Reading".
In this Tech Talk, Darktrace's David Masson and Dark Reading's Terry Sweeney discuss the rise of destructive attacks against critical infrastructure.📖 Read
via "Dark Reading".
Darkreading
Darktrace's David Masson on What Attacks on Critical Infrastructure Look Like
In this Tech Talk, Darktrace's David Masson and Dark Reading's Terry Sweeney discuss the rise of destructive attacks against critical infrastructure.
🕴 12K Misconfigured Elasticsearch Buckets Ravaged by Extortionists 🕴
📖 Read
via "Dark Reading".
The cloud instances were left open to the public Internet with no authentication, allowing attackers to wipe the data.📖 Read
via "Dark Reading".
Dark Reading
12K Misconfigured Elasticsearch Buckets Ravaged by Extortionists
The cloud instances were left open to the public Internet with no authentication, allowing attackers to wipe the data.
🕴 Hunting for Threats Using Network Traffic Flows 🕴
📖 Read
via "Dark Reading".
SeclarityIO's NetworkSage platform analyzes network traffic data to identify attacks before they become real problems.📖 Read
via "Dark Reading".
Dark Reading
Hunting for Threats Using Network Traffic Flows
SeclarityIO's NetworkSage platform analyzes network traffic data to identify attacks before they become real problems.
🕴 FluBot Android Malware Operation Disrupted, Infrastructure Seized 🕴
📖 Read
via "Dark Reading".
Security researchers have described the malware as among the fastest-spreading mobile threats in recent years.📖 Read
via "Dark Reading".
Dark Reading
FluBot Android Malware Operation Disrupted, Infrastructure Seized
Security researchers have described the malware as among the fastest-spreading mobile threats in recent years.
‼ CVE-2022-30128 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-30127.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-30190 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30127 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-30128.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31022 ‼
📖 Read
via "National Vulnerability Database".
Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. There is no patch for this issue because the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26905 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Edge (Chromium-based) Spoofing Vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Darktrace's Brianna Leddy on How Ransomware Groups Adapt to New Defenses 🕴
📖 Read
via "Dark Reading".
In this Tech Talk, Darktrace's Brianna Leddy and Dark Reading's Terry Sweeney discuss ways ransomware groups adapt their activities as enterprise security teams evolve their defenses and controls.📖 Read
via "Dark Reading".
Darkreading
Darktrace's Brianna Leddy on How Ransomware Groups Adapt to New Defenses
In this Tech Talk, Darktrace's Brianna Leddy and Dark Reading's Terry Sweeney discuss ways ransomware groups adapt their activities as enterprise security teams evolve their defenses and controls.
🕴 Managing Extended Software Supply Chain Risks 🕴
📖 Read
via "Dark Reading".
Supply chain woes have dominated headlines, but there's another type of supply chain that's also increasingly at risk: the cloud supply chain.📖 Read
via "Dark Reading".
Dark Reading
Managing Extended Software Supply Chain Risks
Supply chain woes have dominated headlines, but there's another type of supply chain that's also increasingly at risk: the cloud supply chain.