‼ CVE-2022-25807 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has discovered encrypted LDAP bind credentials, to decrypt those credentials using a static 8-byte DES key.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31496 ‼
📖 Read
via "National Vulnerability Database".
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24840 ‼
📖 Read
via "National Vulnerability Database".
django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limited to that location only. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, prior to the release of the patch. The vulnerability has been fixed in version 5.5.1 and above. There is no feasible workaround. We must urge all users to immediately updated to a patched version.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29014 ‼
📖 Read
via "National Vulnerability Database".
A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29013 ‼
📖 Read
via "National Vulnerability Database".
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25805 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree command allows an attacker (who can intercept or inspect traffic between an authenticated UMS client and server) to compromise those LDAP bind credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25806 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has discovered encrypted superuser credentials, to decrypt those credentials using a static 8-byte DES key.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24896 ‼
📖 Read
via "National Vulnerability Database".
Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29254 ‼
📖 Read
via "National Vulnerability Database".
silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-29255 ‼
📖 Read
via "National Vulnerability Database".
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.📖 Read
via "National Vulnerability Database".
⚠ SSNDOB Market domains seized, identity theft “brokerage” shut down ⚠
📖 Read
via "Naked Security".
The online identity "brokerage" SSNDOB Market didn't want people to be in any doubt what it was selling.📖 Read
via "Naked Security".
Naked Security
SSNDOB Market domains seized, identity theft “brokerage” shut down
The online identity “brokerage” SSNDOB Market didn’t want people to be in any doubt what it was selling.
🗓️ Turkish flight operator Pegasus Airlines suffers data breach 🗓️
📖 Read
via "The Daily Swig".
Data protection regulator confirms sensitive information was leaked📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Turkish flight operator Pegasus Airlines suffers data breach
Data protection regulator confirms sensitive information was leaked
⚠ S3 Ep86: The crooks were in our network for HOW long?! [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen (or read) now!📖 Read
via "Naked Security".
Naked Security
S3 Ep86: The crooks were in our network for HOW long?! [Podcast + Transcript]
Latest episode – listen (or read) now!
🕴 How Poor Communication Opens the Door to Ransomware and Extortion 🕴
📖 Read
via "Dark Reading".
Organizations can no longer rely on traditional responses to ransomware.📖 Read
via "Dark Reading".
Dark Reading
How Poor Communication Opens the Door to Ransomware and Extortion
Organizations can no longer rely on traditional responses to ransomware.
‼ CVE-2022-31026 ‼
📖 Read
via "National Vulnerability Database".
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31019 ‼
📖 Read
via "National Vulnerability Database".
Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40668 ‼
📖 Read
via "National Vulnerability Database".
The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40610 ‼
📖 Read
via "National Vulnerability Database".
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31027 ‼
📖 Read
via "National Vulnerability Database".
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institutions whose users are authorized to access this JupyterHub. This authorization is validated by ensuring that the *email* field provided to us by CILogon has a *domain* that matches one of the domains listed in `allowed_idps`.If `allowed_idps` contains `berkeley.edu`, you might expect only users with valid current credentials provided by University of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider is used by the user to login, only the email address provided. So a user can login with a GitHub account that has email set to `<something>@berkeley.edu`, and that will be treated exactly the same as someone logging in using the UC Berkeley official Identity Provider. The patch fixing this issue makes a *breaking change* in how `allowed_idps` is interpreted. It's no longer a list of domains, but configuration representing the `EntityID` of the IdPs that are allowed, picked from the [list maintained by CILogon](https://cilogon.org/idplist/). Users are advised to upgrade.📖 Read
via "National Vulnerability Database".
🕴 37 Major Companies and Organizations Pledge to Enhance Cyber Resiliency and Counter Evolving Global Threats 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
37 Major Companies and Organizations Pledge to Enhance Cyber Resiliency and Counter Evolving Global Threats
🕴 ReliaQuest Bolsters Extended Detection With Threat Intelligence 🕴
📖 Read
via "Dark Reading".
ReliaQuest CTO Joe Partlow joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss extended detection response — and acquisition news.📖 Read
via "Dark Reading".
Darkreading
ReliaQuest Bolsters Extended Detection With Threat Intelligence
ReliaQuest CTO Joe Partlow joins Dark Reading's Terry Sweeney at Dark Reading News Desk during RSA Conference to discuss extended detection response — and acquisition news.