🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2018-25043 ‼

A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

📖 Read

via "National Vulnerability Database".

185 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2019-12357 ‼

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id parameter.

📖 Read

via "National Vulnerability Database".

167 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2020-36547 ‼

A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings.

📖 Read

via "National Vulnerability Database".

153 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2020-36548 ‼

A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host.

📖 Read

via "National Vulnerability Database".

145 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2021-45025 ‼

ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie.

📖 Read

via "National Vulnerability Database".

137 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-31784 ‼

A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.

📖 Read

via "National Vulnerability Database".

134 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-2111 ‼

Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.

📖 Read

via "National Vulnerability Database".

128 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-2113 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.

📖 Read

via "National Vulnerability Database".

126 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-33915 ‼

Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local privilege escalation. This Hotpatch package is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 or CVE-2021-45046; it provides a temporary mitigation to CVE-2021-44228 by hotpatching the local Java virtual machines. To do so, it iterates through all running Java processes, performs several checks, and executes the Java virtual machine with the same permissions and capabilities as the running process to load the hotpatch. A local user could cause the hotpatch script to execute a binary with elevated privileges by running a custom java process that performs exec() of an SUID binary after the hotpatch has observed the process path and before it has observed its effective user ID.

📖 Read

via "National Vulnerability Database".

130 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-2112 ‼

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

📖 Read

via "National Vulnerability Database".

129 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2018-25042 ‼

A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.

📖 Read

via "National Vulnerability Database".

137 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2019-12359 ‼

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter.

📖 Read

via "National Vulnerability Database".

132 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2019-12358 ‼

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie.

📖 Read

via "National Vulnerability Database".

136 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-31296 ‼

Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.

📖 Read

via "National Vulnerability Database".

139 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-32276 ‼

** DISPUTED ** Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability.

📖 Read

via "National Vulnerability Database".

141 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2020-36549 ‼

A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.

📖 Read

via "National Vulnerability Database".

153 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2021-41490 ‼

Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.

📖 Read

via "National Vulnerability Database".

163 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2022-33912 ‼

A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the user and the group with ID 1001. If such a user exists on the system, they can change the content of these files (which are then executed by root). This leads to a local privilege escalation on the monitored host. Version 1.6 through 1.6.9p29, version 2.0 through 2.0.0p26, version 2.1 through 2.1.0p3, and version 2.2.0i1 are affected.

📖 Read

via "National Vulnerability Database".

199 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2021-45026 ‼

ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).

📖 Read

via "National Vulnerability Database".

233 views14:23

🛡 Cybersecurity & Privacy 🛡 - News

🗓️ Reddit patches CSRF vulnerability that forced users to view NSFW content 🗓️

Mischievous hackers exploiting flaw could subvert ‘not safe for work’ restrictions

📖 Read

via "The Daily Swig".

The Daily Swig | Cybersecurity news and views

Reddit patches CSRF vulnerability that forced users to view NSFW content

Mischievous hackers exploiting flaw could subvert ‘not safe for work’ restrictions

239 views15:40

🛡 Cybersecurity & Privacy 🛡 - News

⚠ S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast] ⚠

Lastest epsiode - listen now!

📖 Read

via "Naked Security".

Naked Security

S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]

Lastest epsiode – listen now!

221 views16:23

About

Blog

Apps

Platform