‼ CVE-2022-30882 ‼
📖 Read
via "National Vulnerability Database".
pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.📖 Read
via "National Vulnerability Database".
🕴 Concentric: How To Maximize Your AI Returns, In and Out of the SOC 🕴
📖 Read
via "Dark Reading".
Concentric AI's Karthik Krishnan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how artificial intelligence has transformed the security landscape.📖 Read
via "Dark Reading".
Darkreading
ConcentricAI: How To Maximize Your AI Returns, In and Out of the SOC
Concentric AI's Karthik Krishnan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how artificial intelligence has transformed the security landscape.
🕴 DeepSurface Security: Risk-Based Prioritization Adds New Depth to Vulnerability Management 🕴
📖 Read
via "Dark Reading".
DeepSurface's Tim Morgan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how to fortify vulnerability management.📖 Read
via "Dark Reading".
Darkreading
DeepSurface Security: Risk-Based Prioritization Adds New Depth to Vulnerability Management
DeepSurface's Tim Morgan joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how to fortify vulnerability management.
🕴 Anjuna Security: Tapping ‘Confidential Computing’ to Secure Data, Users, and Organizations 🕴
📖 Read
via "Dark Reading".
Anjuna Security's Ayal Yogev joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how confidential computing will improve cloud security.📖 Read
via "Dark Reading".
Dark Reading
Anjuna Security: Tapping ‘Confidential Computing’ to Secure Data, Users, and Organizations
Anjuna Security's Ayal Yogev joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss how confidential computing will improve cloud security.
🕴 Security & Productivity: The New Power Couple 🕴
📖 Read
via "Dark Reading".
Seemplicity's Ravid Circus joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to talk up accelerating time-to-remediation and reducing risk.📖 Read
via "Dark Reading".
Darkreading
Security & Productivity: The New Power Couple
Seemplicity's Ravid Circus joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to talk up accelerating time-to-remediation and reducing risk.
‼ CVE-2022-25804 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEY_LOCAL_MACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32195 ‼
📖 Read
via "National Vulnerability Database".
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30075 ‼
📖 Read
via "National Vulnerability Database".
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31649 ‼
📖 Read
via "National Vulnerability Database".
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25807 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has discovered encrypted LDAP bind credentials, to decrypt those credentials using a static 8-byte DES key.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31496 ‼
📖 Read
via "National Vulnerability Database".
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24840 ‼
📖 Read
via "National Vulnerability Database".
django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limited to that location only. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, prior to the release of the patch. The vulnerability has been fixed in version 5.5.1 and above. There is no feasible workaround. We must urge all users to immediately updated to a patched version.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29014 ‼
📖 Read
via "National Vulnerability Database".
A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29013 ‼
📖 Read
via "National Vulnerability Database".
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25805 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree command allows an attacker (who can intercept or inspect traffic between an authenticated UMS client and server) to compromise those LDAP bind credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25806 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has discovered encrypted superuser credentials, to decrypt those credentials using a static 8-byte DES key.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24896 ‼
📖 Read
via "National Vulnerability Database".
Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29254 ‼
📖 Read
via "National Vulnerability Database".
silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-29255 ‼
📖 Read
via "National Vulnerability Database".
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.📖 Read
via "National Vulnerability Database".
⚠ SSNDOB Market domains seized, identity theft “brokerage” shut down ⚠
📖 Read
via "Naked Security".
The online identity "brokerage" SSNDOB Market didn't want people to be in any doubt what it was selling.📖 Read
via "Naked Security".
Naked Security
SSNDOB Market domains seized, identity theft “brokerage” shut down
The online identity “brokerage” SSNDOB Market didn’t want people to be in any doubt what it was selling.
🗓️ Turkish flight operator Pegasus Airlines suffers data breach 🗓️
📖 Read
via "The Daily Swig".
Data protection regulator confirms sensitive information was leaked📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Turkish flight operator Pegasus Airlines suffers data breach
Data protection regulator confirms sensitive information was leaked