🕴 Tackling 5 Challenges Facing Critical National Infrastructure Today 🕴
📖 Read
via "Dark Reading".
The stakes are high when protecting CNI from destructive malware and other threats.📖 Read
via "Dark Reading".
Dark Reading
Tackling 5 Challenges Facing Critical National Infrastructure Today
The stakes are high when protecting CNI from destructive malware and other threats.
❌ China-linked APT Flew Under Radar for Decade ❌
📖 Read
via "Threat Post".
Evidence suggests that a just-discovered APT has been active since 2013.📖 Read
via "Threat Post".
Threat Post
China-linked APT Flew Under Radar for Decade
Evidence suggests that a just-discovered APT has been active since 2013.
‼ CVE-2019-12354 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-25043 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-12357 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36547 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36548 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45025 ‼
📖 Read
via "National Vulnerability Database".
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31784 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2111 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2113 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33915 ‼
📖 Read
via "National Vulnerability Database".
Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local privilege escalation. This Hotpatch package is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 or CVE-2021-45046; it provides a temporary mitigation to CVE-2021-44228 by hotpatching the local Java virtual machines. To do so, it iterates through all running Java processes, performs several checks, and executes the Java virtual machine with the same permissions and capabilities as the running process to load the hotpatch. A local user could cause the hotpatch script to execute a binary with elevated privileges by running a custom java process that performs exec() of an SUID binary after the hotpatch has observed the process path and before it has observed its effective user ID.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2112 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-25042 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-12359 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-12358 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31296 ‼
📖 Read
via "National Vulnerability Database".
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32276 ‼
📖 Read
via "National Vulnerability Database".
** DISPUTED ** Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36549 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41490 ‼
📖 Read
via "National Vulnerability Database".
Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33912 ‼
📖 Read
via "National Vulnerability Database".
A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the user and the group with ID 1001. If such a user exists on the system, they can change the content of these files (which are then executed by root). This leads to a local privilege escalation on the monitored host. Version 1.6 through 1.6.9p29, version 2.0 through 2.0.0p26, version 2.1 through 2.1.0p3, and version 2.2.0i1 are affected.📖 Read
via "National Vulnerability Database".