‼ CVE-2022-31595 ‼
📖 Read
via "National Vulnerability Database".
SAP Financial Consolidation - version 1010,?does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32235 ‼
📖 Read
via "National Vulnerability Database".
When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29238 ‼
📖 Read
via "National Vulnerability Database".
Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32366 ‼
📖 Read
via "National Vulnerability Database".
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29614 ‼
📖 Read
via "National Vulnerability Database".
SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, SAPHOSTAGENT 7.22, - on Unix systems, s-bit helper program sapuxuserchk, can be abused physically resulting in a privilege escalation of an attacker leading to low impact on confidentiality and integrity, but a profound impact on availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31589 ‼
📖 Read
via "National Vulnerability Database".
Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2022-29615 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21504 ‼
📖 Read
via "National Vulnerability Database".
The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socket to be closed and freed while it was still in use by another portion of the kernel. An attack with local access can operate on the socket, and cause a denial of service. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32367 ‼
📖 Read
via "National Vulnerability Database".
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=inquiries/view_inquiry&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31594 ‼
📖 Read
via "National Vulnerability Database".
A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system.📖 Read
via "National Vulnerability Database".
♟️ Ransomware Group Debuts Searchable Victim Data ♟️
📖 Read
via "Krebs on Security".
Cybercrime groups that specialize in stealing corporate data and demanding a ransom not to publish it have tried countless approaches to shaming their victims into paying. The latest innovation in ratcheting up the heat comes from the ALPHV/BlackCat ransomware group, which has traditionally published any stolen victim data on the Dark Web. Today, however, the group began publishing individual victim websites on the public Internet, with the leaked data made available in an easily searchable form.📖 Read
via "Krebs on Security".
Krebs on Security
Ransomware Group Debuts Searchable Victim Data
Cybercrime groups that specialize in stealing corporate data and demanding a ransom not to publish it have tried countless approaches to shaming their victims into paying. The latest innovation in ratcheting up the heat comes from the ALPHV/BlackCat ransomware…
🕴 DDoS Subscription Service Operator Gets 2 Years in Prison 🕴
📖 Read
via "Dark Reading".
The distributed denial-as-a-service websites were behind more than 200K attacks on targets including schools and hospitals.📖 Read
via "Dark Reading".
Dark Reading
DDoS Subscription Service Operator Gets 2 Years in Prison
The distributed denial-as-a-service websites were behind more than 200K attacks on targets including schools and hospitals.
🕴 Veterans Explain How Military Service Prepared Them for Cybersecurity Careers 🕴
📖 Read
via "Dark Reading".
The ability to handle intense pressure is just one of the skills that veterans bring to corporate cybersecurity work.📖 Read
via "Dark Reading".
Dark Reading
Veterans Explain How Military Service Prepared Them for Cybersecurity Careers
The ability to handle intense pressure is just one of the skills that veterans bring to corporate cybersecurity work.
‼ CVE-2022-31046 ‼
📖 Read
via "National Vulnerability Database".
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32239 ‼
📖 Read
via "National Vulnerability Database".
When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31048 ‼
📖 Read
via "National Vulnerability Database".
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32359 ‼
📖 Read
via "National Vulnerability Database".
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_category.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32353 ‼
📖 Read
via "National Vulnerability Database".
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_field_order.php?id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32236 ‼
📖 Read
via "National Vulnerability Database".
When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31059 ‼
📖 Read
via "National Vulnerability Database".
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31060 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.📖 Read
via "National Vulnerability Database".