🗓️ Reddit patches CSRF vulnerability that forced users to view NSFW content 🗓️
📖 Read
via "The Daily Swig".
Mischievous hackers exploiting flaw could subvert ‘not safe for work’ restrictions📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Reddit patches CSRF vulnerability that forced users to view NSFW content
Mischievous hackers exploiting flaw could subvert ‘not safe for work’ restrictions
⚠ S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast] ⚠
📖 Read
via "Naked Security".
Lastest epsiode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]
Lastest epsiode – listen now!
‼ CVE-2022-31355 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31246 ‼
📖 Read
via "National Vulnerability Database".
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31356 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40903 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31357 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.📖 Read
via "National Vulnerability Database".
🗓️ Russian botnet ‘RSOCKS’ dismantled after hacking millions of devices 🗓️
📖 Read
via "The Daily Swig".
Sock it to ‘em📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Russian botnet ‘RSOCKS’ dismantled after hacking millions of devices
Sock it to ‘em
‼ CVE-2022-22485 ‼
📖 Read
via "National Vulnerability Database".
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server. IBM X-Force ID: 226325.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30422 ‼
📖 Read
via "National Vulnerability Database".
Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32444 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32442 ‼
📖 Read
via "National Vulnerability Database".
u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl (96502)%27bad=", it can cause html injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30607 ‼
📖 Read
via "National Vulnerability Database".
IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294.📖 Read
via "National Vulnerability Database".
🕴 Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware 🕴
📖 Read
via "Dark Reading".
Most of the attacks involve the use of automated exploits, security vendor says.📖 Read
via "Dark Reading".
Dark Reading
Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware
Most of the attacks involve the use of automated exploits, security vendor says.
🕴 DeadBolt Ransomware Actively Targets QNAP NAS Devices — Again 🕴
📖 Read
via "Dark Reading".
The QNAP network-connected devices, used to store video surveillance footage, are a juicy target for attackers, experts warn.📖 Read
via "Dark Reading".
Dark Reading
DeadBolt Ransomware Actively Targets QNAP NAS Devices — Again
The QNAP network-connected devices, used to store video surveillance footage, are a juicy target for attackers, experts warn.
🕴 WordPress Plug-in Ninja Forms Issues Update for Critical Bug 🕴
📖 Read
via "Dark Reading".
The code injection vulnerability is being actively exploited in the wild, researchers say.📖 Read
via "Dark Reading".
Dark Reading
WordPress Plug-in Ninja Forms Issues Update for Critical Bug
The code injection vulnerability is being actively exploited in the wild, researchers say.
‼ CVE-2022-21806 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21184 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31083 ‼
📖 Read
via "National Vulnerability Database".
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Versions 4.0.11 and 5.2.2 prevent this by introducing a new `rootCertificateUrl` property to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the current root certificate as of May 27, 2022. Keep in mind that the root certificate can change at any time and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31941 ‼
📖 Read
via "National Vulnerability Database".
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29496 ‼
📖 Read
via "National Vulnerability Database".
A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".