‼ CVE-2022-28385 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive (containing the Windows and macOS client software). The content of this emulated CD-ROM drive is stored as an ISO-9660 image in the hidden sectors of the USB drive, that can only be accessed using special IOCTL commands, or when installing the drive in an external disk enclosure. By manipulating this ISO-9660 image or replacing it with another one, an attacker is able to store malicious software on the emulated CD-ROM drive. This software may get executed by an unsuspecting victim when using the device. For example, an attacker with temporary physical access during the supply chain could program a modified ISO-9660 image on a device that always accepts an attacker-controlled password for unlocking the device. If the attacker later on gains access to the used USB drive, he can simply decrypt all contained user data. Storing arbitrary other malicious software is also possible. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28387 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28383 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28384 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the correct passcode, and thus gaining unauthorized access to the stored encrypted data. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32273 ‼
📖 Read
via "National Vulnerability Database".
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30899 ‼
📖 Read
via "National Vulnerability Database".
A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.📖 Read
via "National Vulnerability Database".
🕴 Black Basta Ransomware Targets ESXi Servers in Active Campaign 🕴
📖 Read
via "Dark Reading".
The new ransomware strain Black Basta is now actively targeting VMware ESXi servers in an ongoing campaign, encrypting files inside a targeted volumes folder.📖 Read
via "Dark Reading".
Dark Reading
Black Basta Ransomware Targets ESXi Servers in Active Campaign
The new ransomware strain Black Basta is now actively targeting VMware ESXi servers in an ongoing campaign, encrypting files inside a targeted volumes folder.
🕴 Talon Grasps Victory at a Jubilant RSAC Innovation Sandbox 🕴
📖 Read
via "Dark Reading".
Spirits were high at the return of the in-person contest, which kicked off by bringing last year's virtual event winner on stage.📖 Read
via "Dark Reading".
Dark Reading
Talon Grasps Victory at a Jubilant RSAC Innovation Sandbox
Spirits were high at the return of the in-person contest, which kicked off by bringing last year's virtual event winner on stage.
🔏 Cybersecurity, Data Protection Top Litigation Concerns 🔏
📖 Read
via "".
A survey of in-house counsel at organizations worldwide suggests cybersecurity and data protection disputes were top of mind in 2021.📖 Read
via "".
‼ CVE-2021-40589 ‼
📖 Read
via "National Vulnerability Database".
ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30877 ‼
📖 Read
via "National Vulnerability Database".
The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40592 ‼
📖 Read
via "National Vulnerability Database".
GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file.📖 Read
via "National Vulnerability Database".
🕴 Lookout: Getting It Right at the Secure Service Edge 🕴
📖 Read
via "Dark Reading".
Lookout's Jim Dolce joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss the advantages of Secure Service Edge.📖 Read
via "Dark Reading".
Darkreading
Getting It Right at the Secure Service Edge
Lookout's Jim Dolce joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss the advantages of Secure Service Edge.
‼ CVE-2022-31313 ‼
📖 Read
via "National Vulnerability Database".
api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30882 ‼
📖 Read
via "National Vulnerability Database".
pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.📖 Read
via "National Vulnerability Database".
🕴 Concentric: How To Maximize Your AI Returns, In and Out of the SOC 🕴
📖 Read
via "Dark Reading".
Concentric AI's Karthik Krishnan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how artificial intelligence has transformed the security landscape.📖 Read
via "Dark Reading".
Darkreading
ConcentricAI: How To Maximize Your AI Returns, In and Out of the SOC
Concentric AI's Karthik Krishnan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how artificial intelligence has transformed the security landscape.
🕴 DeepSurface Security: Risk-Based Prioritization Adds New Depth to Vulnerability Management 🕴
📖 Read
via "Dark Reading".
DeepSurface's Tim Morgan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how to fortify vulnerability management.📖 Read
via "Dark Reading".
Darkreading
DeepSurface Security: Risk-Based Prioritization Adds New Depth to Vulnerability Management
DeepSurface's Tim Morgan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how to fortify vulnerability management.
🕴 Anjuna Security: Tapping ‘Confidential Computing’ to Secure Data, Users, and Organizations 🕴
📖 Read
via "Dark Reading".
Anjuna Security's Ayal Yogev joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how confidential computing will improve cloud security.📖 Read
via "Dark Reading".
Dark Reading
Anjuna Security: Tapping ‘Confidential Computing’ to Secure Data, Users, and Organizations
Anjuna Security's Ayal Yogev joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how confidential computing will improve cloud security.
🕴 Security & Productivity: The New Power Couple 🕴
📖 Read
via "Dark Reading".
Seemplicity's Ravid Circus joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to talk up accelerating time-to-remediation and reducing risk.📖 Read
via "Dark Reading".
Darkreading
Security & Productivity: The New Power Couple
Seemplicity's Ravid Circus joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to talk up accelerating time-to-remediation and reducing risk.
‼ CVE-2022-25804 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEY_LOCAL_MACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32195 ‼
📖 Read
via "National Vulnerability Database".
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.📖 Read
via "National Vulnerability Database".