‼ CVE-2022-29241 ‼
📖 Read
via "National Vulnerability Database".
Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this URL can be used from a cross-site scripting payload or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact with Jupyter services/notebooks such as modifying or overwriting critical files, such as .bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially sensitive data and possibly gain control of the impacted system. This issue is patched in version 1.17.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32237 ‼
📖 Read
via "National Vulnerability Database".
When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31050 ‼
📖 Read
via "National Vulnerability Database".
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32363 ‼
📖 Read
via "National Vulnerability Database".
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/view_category.php?id=.📖 Read
via "National Vulnerability Database".
⚠ Follina gets fixed – but it’s not listed in the Patch Tuesday patches! ⚠
📖 Read
via "Naked Security".
We tried it out to make sure, so you don't have to.📖 Read
via "Naked Security".
Naked Security
Follina gets fixed – but it’s not listed in the Patch Tuesday patches!
We tried it out to make sure, so you don’t have to.
👍2
🗓️ Data breach at US ambulance billing service Comstar exposed patients’ healthcare information 🗓️
📖 Read
via "The Daily Swig".
Medical payments company admits network intrusion📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Data breach at US ambulance billing service Comstar exposed patients’ healthcare information
Medical payments company admits network intrusion
👍1
‼ CVE-2021-40212 ‼
📖 Read
via "National Vulnerability Database".
An exploitable out-of-bounds write vulnerability in PotPlayer 1.7.21523 build 210729 may lead to code execution, information disclosure, and denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1958 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in FileCloud. Affected is the NTFS handler which leads to improper access controls. It is possible to launch the attack remotely but it demands some form of authentication. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component.📖 Read
via "National Vulnerability Database".
🗓️ Security researcher receives legal threat over patched Powertek data center vulnerabilities 🗓️
📖 Read
via "The Daily Swig".
Vendor threatened legal action following disclosure and fixes being issued, bug hunter claims📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Security researcher receives legal threat over patched Powertek data center vulnerabilities
Vendor threatened legal action following disclosure and fixes being issued, bug hunter claims
❌ Travel-related Cybercrime Takes Off as Industry Rebounds ❌
📖 Read
via "Threat Post".
Upsurge in the tourism industry after the COVID-19 pandemic grabs the attention of cybercriminals to scam the tourists.📖 Read
via "Threat Post".
Threat Post
Travel-related Cybercrime Takes Off as Industry Rebounds
Upsurge in the tourism industry after the COVID-19 pandemic grabs the attention of cybercriminals to scam the tourists.
❌ In Cybersecurity, What You Can’t See Can Hurt You ❌
📖 Read
via "Threat Post".
The dangers to SMBs and businesses of all sizes from cyberattacks are well known. But what’s driving these attacks, and what do cybersecurity stakeholders need to do that they’re not already doing?📖 Read
via "Threat Post".
Threat Post
In Cybersecurity, What You Can’t See Can Hurt You
Lack of network visibility is overriding deficiency in cybersecurity based on SOC platform provider CYREBRO’s report examining SMBs to enterprises.
❌ DragonForce Gang Unleash Hacks Against Govt. of India ❌
📖 Read
via "Threat Post".
In response to a comment about the Prophet Mohammed, a hacktivist group in Malaysia has unleashed a wave of cyber attacks in India.📖 Read
via "Threat Post".
Threat Post
DragonForce Gang Unleash Hacks Against Govt. of India
In response to a comment about the Prophet Mohammed, a hacktivist group in Malaysia has unleashed a wave of cyber attacks in India.
‼ CVE-2022-20132 ‼
📖 Read
via "National Vulnerability Database".
In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20137 ‼
📖 Read
via "National Vulnerability Database".
In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-206986392📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41413 ‼
📖 Read
via "National Vulnerability Database".
ok-file-formats master 2021-9-12 is affected by a buffer overflow in ok_jpg_convert_data_unit_grayscale and ok_jpg_convert_YCbCr_to_RGB.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39691 ‼
📖 Read
via "National Vulnerability Database".
In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-157929241📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2086 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep(10),3,4,5 --+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20125 ‼
📖 Read
via "National Vulnerability Database".
In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-194402515📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20135 ‼
📖 Read
via "National Vulnerability Database".
In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220303465📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20129 ‼
📖 Read
via "National Vulnerability Database".
In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-217934478📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20124 ‼
📖 Read
via "National Vulnerability Database".
In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-170646036📖 Read
via "National Vulnerability Database".