βΌ CVE-2022-31018 βΌ
π Read
via "National Vulnerability Database".
Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` method on a JSON request body or the `Form#bind` method directly on a JSON value. If the JSON data being bound to the form contains a deeply-nested JSON object or array, the form binding implementation may consume all available heap space and cause an `OutOfMemoryError`. If executing on the default dispatcher and `akka.jvm-exit-on-fatal-error` is enabledΓΒ’Γ’β¬Òβ¬οΏ½as it is by defaultΓΒ’Γ’β¬Òβ¬οΏ½then this can crash the application process. `Form.bindFromRequest` is vulnerable when using any body parser that produces a type of `AnyContent` or `JsValue` in Scala, or one that can produce a `JsonNode` in Java. This includes Play's default body parser. This vulnerability been patched in version 2.8.16. There is now a global limit on the depth of a JSON object that can be parsed, which can be configured by the user if necessary. As a workaround, applications that do not need to parse a request body of type `application/json` can switch from the default body parser to another body parser that supports only the specific type of body they expect.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32022 βΌ
π Read
via "National Vulnerability Database".
Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32027 βΌ
π Read
via "National Vulnerability Database".
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage_car&id=.π Read
via "National Vulnerability Database".
βΌ CVE-2022-31993 βΌ
π Read
via "National Vulnerability Database".
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_service.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32020 βΌ
π Read
via "National Vulnerability Database".
Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=save_settings.π Read
via "National Vulnerability Database".
βΌ CVE-2022-31986 βΌ
π Read
via "National Vulnerability Database".
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_court_rental_report&date=.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32021 βΌ
π Read
via "National Vulnerability Database".
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_movement.php?id=.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32028 βΌ
π Read
via "National Vulnerability Database".
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32010 βΌ
π Read
via "National Vulnerability Database".
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32011 βΌ
π Read
via "National Vulnerability Database".
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=.π Read
via "National Vulnerability Database".
π΄ Turbulent Cyber Insurance Market Sees Rising Prices and Sinking Coverage π΄
π Read
via "Dark Reading".
As insurers and brokers reckon with unexpected losses, they're charging more for policies and setting higher requirements.π Read
via "Dark Reading".
Dark Reading
Turbulent Cyber Insurance Market Sees Rising Prices and Sinking Coverage
As insurers and brokers reckon with unexpected losses, they're charging more for policies and setting higher requirements.
π1
π΄ CyberQ Technologies Inc. Launches Managed AI for Splunk UBA Customers π΄
π Read
via "Dark Reading".
.π Read
via "Dark Reading".
Dark Reading
CyberQ Technologies Inc. Launches Managed AI for Splunk UBA Customers
π΄ Neosec Introduces Expert Managed Threat Hunting Service for Detecting and Investigating API Abuse and Vulnerabilities π΄
π Read
via "Dark Reading".
Neosec threat hunters from the 'ShadowHunt' team jumpstart the API Security process quickly and help build the knowledge in today's overstretched security teams.π Read
via "Dark Reading".
Dark Reading
Neosec Introduces Expert Managed Threat Hunting Service for Detecting and Investigating API Abuse and Vulnerabilities
Neosec threat hunters from the 'ShadowHunt' team jumpstart the API Security process quickly and help build the knowledge in today's overstretched security teams.
π΄ Phishers Having a Field Day on WhatsApp, Telegraph π΄
π Read
via "Dark Reading".
A pair of phishing campaigns against users of WhatsApp and Telegram's Telegraph expose them to extortion, credential harvesting, and even account takeover.π Read
via "Dark Reading".
Dark Reading
Phishers Having a Field Day on WhatsApp, Telegraph
A pair of phishing campaigns against users of WhatsApp and Telegram's Telegraph expose them to extortion, credential harvesting, and even account takeover.
π΄ New Cloud Pricing and Products Proof of RSAβs Transformation π΄
π Read
via "Dark Reading".
RSA pivots to exclusive focus. Identity is once again the βbeating heartβ of RSA.π Read
via "Dark Reading".
Dark Reading
New Cloud Pricing and Products Proof of RSAβs Transformation
RSA pivots to exclusive focus. Identity is once again the βbeating heartβ of RSA.
π΄ US Sanctions Force Evil Corp to Change Tactics π΄
π Read
via "Dark Reading".
The threat actor behind the notorious Dridex campaign has switched from using its exclusive credential-harvesting malware to a ransomware-as-a-service model, to make attribution harder.π Read
via "Dark Reading".
Dark Reading
US Sanctions Force Evil Corp to Change Tactics
The threat actor behind the notorious Dridex campaign has switched from using its exclusive credential-harvesting malware to a ransomware-as-a-service model, to make attribution harder.
π΄ Microsoft Philanthropies Collaborates With WiCyS to Help Close the Cybersecurity Skills Gap π΄
π Read
via "Dark Reading".
Microsoft Philanthropies is expanding its cybersecurity skills for jobs campaign to 23 countries and partnering with Women in CyberSecurity (WiCyS) to build a cybersecurity workforce that is not just larger but also more diverse.π Read
via "Dark Reading".
Dark Reading
Cybersecurity Careers recent news | Dark Reading
Explore the latest news and expert commentary on Cybersecurity Careers, brought to you by the editors of Dark Reading
βΌ CVE-2022-25163 βΌ
π Read
via "National Vulnerability Database".
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on the target products by sending specially crafted packets.π Read
via "National Vulnerability Database".
βΌ CVE-2022-30429 βΌ
π Read
via "National Vulnerability Database".
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1982 βΌ
π Read
via "National Vulnerability Database".
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.π Read
via "National Vulnerability Database".
βΌ CVE-2022-26497 βΌ
π Read
via "National Vulnerability Database".
BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.π Read
via "National Vulnerability Database".