‼ CVE-2021-40903 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31357 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.📖 Read
via "National Vulnerability Database".
🗓️ Russian botnet ‘RSOCKS’ dismantled after hacking millions of devices 🗓️
📖 Read
via "The Daily Swig".
Sock it to ‘em📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Russian botnet ‘RSOCKS’ dismantled after hacking millions of devices
Sock it to ‘em
‼ CVE-2022-22485 ‼
📖 Read
via "National Vulnerability Database".
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server. IBM X-Force ID: 226325.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30422 ‼
📖 Read
via "National Vulnerability Database".
Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32444 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32442 ‼
📖 Read
via "National Vulnerability Database".
u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl (96502)%27bad=", it can cause html injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30607 ‼
📖 Read
via "National Vulnerability Database".
IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294.📖 Read
via "National Vulnerability Database".
🕴 Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware 🕴
📖 Read
via "Dark Reading".
Most of the attacks involve the use of automated exploits, security vendor says.📖 Read
via "Dark Reading".
Dark Reading
Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware
Most of the attacks involve the use of automated exploits, security vendor says.
🕴 DeadBolt Ransomware Actively Targets QNAP NAS Devices — Again 🕴
📖 Read
via "Dark Reading".
The QNAP network-connected devices, used to store video surveillance footage, are a juicy target for attackers, experts warn.📖 Read
via "Dark Reading".
Dark Reading
DeadBolt Ransomware Actively Targets QNAP NAS Devices — Again
The QNAP network-connected devices, used to store video surveillance footage, are a juicy target for attackers, experts warn.
🕴 WordPress Plug-in Ninja Forms Issues Update for Critical Bug 🕴
📖 Read
via "Dark Reading".
The code injection vulnerability is being actively exploited in the wild, researchers say.📖 Read
via "Dark Reading".
Dark Reading
WordPress Plug-in Ninja Forms Issues Update for Critical Bug
The code injection vulnerability is being actively exploited in the wild, researchers say.
‼ CVE-2022-21806 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21184 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31083 ‼
📖 Read
via "National Vulnerability Database".
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Versions 4.0.11 and 5.2.2 prevent this by introducing a new `rootCertificateUrl` property to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the current root certificate as of May 27, 2022. Keep in mind that the root certificate can change at any time and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31941 ‼
📖 Read
via "National Vulnerability Database".
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29496 ‼
📖 Read
via "National Vulnerability Database".
A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Ransomware and Phishing Remain IT's Biggest Concerns 🕴
📖 Read
via "Dark Reading".
Security teams — who are already fighting off malware challenges — are also facing renewed attacks on cloud assets and remote systems.📖 Read
via "Dark Reading".
Dark Reading
Ransomware and Phishing Remain IT's Biggest Concerns
Security teams — who are already fighting off malware challenges — are also facing renewed attacks on cloud assets and remote systems.
‼ CVE-2022-25856 ‼
📖 Read
via "National Vulnerability Database".
The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31873 ‼
📖 Read
via "National Vulnerability Database".
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31875 ‼
📖 Read
via "National Vulnerability Database".
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25871 ‼
📖 Read
via "National Vulnerability Database".
All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).📖 Read
via "National Vulnerability Database".