βΌ CVE-2022-1695 βΌ
π Read
via "National Vulnerability Database".
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1394 βΌ
π Read
via "National Vulnerability Database".
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowedπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1691 βΌ
π Read
via "National Vulnerability Database".
The Realty Workstation WordPress plugin through 1.0.6 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injectionπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1683 βΌ
π Read
via "National Vulnerability Database".
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX actionπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1421 βΌ
π Read
via "National Vulnerability Database".
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attackπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1469 βΌ
π Read
via "National Vulnerability Database".
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowedπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1689 βΌ
π Read
via "National Vulnerability Database".
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injectionπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1687 βΌ
π Read
via "National Vulnerability Database".
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injectionπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1424 βΌ
π Read
via "National Vulnerability Database".
The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1577 βΌ
π Read
via "National Vulnerability Database".
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup scheduleπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1570 βΌ
π Read
via "National Vulnerability Database".
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1422 βΌ
π Read
via "National Vulnerability Database".
The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.π Read
via "National Vulnerability Database".
β Paying Ransomware Paints Bigger Bullseye on Targetβs Back β
π Read
via "Threat Post".
Ransomware attackers often strike targets twice, regardless of whether the ransom was paid.π Read
via "Threat Post".
Threat Post
Paying Ransomware Paints Bigger Bullseye on Targetβs Back
Ransomware attackers often strike targets twice, regardless of whether the ransom was paid.
β Taming the Digital Asset Tsunami β
π Read
via "Threat Post".
Rob Gurzeev, CEO and Co-Founder of CyCognito, explores external attack surface soft spots tied to an ever-expanding number of digital assets companies too often struggle to keep track of and manage effectively.π Read
via "Threat Post".
Threat Post
Taming the Digital Asset Tsunami
Rob Gurzeev, CEO and Co-Founder of CyCognito, explores external attack surface soft spots tied to an ever-expanding number of digital assets companies too often struggle to keep track of and manage effectively.
π΄ How Do We Secure Our Cities From Attack? π΄
π Read
via "Dark Reading".
Physical access matters in keeping people and buildings safe. Points to consider when establishing a physical security protocol are ways to lock down an area to keep people safe, approaches to communicate clear safety directions, and access control.π Read
via "Dark Reading".
Dark Reading
How Do We Secure Our Cities From Attack?
Physical access matters in keeping people and buildings safe. Points to consider when establishing a physical security protocol are ways to lock down an area to keep people safe, approaches to communicate clear safety directions, and access control.
β Know your enemy! Learn how cybercrime adversaries get inβ¦ β
π Read
via "Naked Security".
Here's how 144 recent attacks actually went down in real life. Don't let this happen to you!π Read
via "Naked Security".
Naked Security
Know your enemy! Learn how cybercrime adversaries get inβ¦
Hereβs how 144 recent attacks actually went down in real life. Donβt let this happen to you!
ποΈ WWDC 2022: Apple showcases next-gen security tech at annual developer event ποΈ
π Read
via "The Daily Swig".
Passkeys, Safety Check, and Private Access Tokens demonstrated during week-long virtual conferenceπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
WWDC 2022: Apple showcases next-gen security tech at annual developer event
Passkeys, Safety Check, and Private Access Tokens demonstrated during week-long virtual conference
π1
βΌ CVE-2022-31497 βΌ
π Read
via "National Vulnerability Database".
LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.π Read
via "National Vulnerability Database".
βΌ CVE-2022-30552 βΌ
π Read
via "National Vulnerability Database".
Das U-Boot 2022.01 has a Buffer Overflow.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1996 βΌ
π Read
via "National Vulnerability Database".
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.π Read
via "National Vulnerability Database".
βΌ CVE-2022-30790 βΌ
π Read
via "National Vulnerability Database".
Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552.π Read
via "National Vulnerability Database".