‼ CVE-2022-31306 ‼
📖 Read
via "National Vulnerability Database".
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31374 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31307 ‼
📖 Read
via "National Vulnerability Database".
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33139 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.📖 Read
via "National Vulnerability Database".
🕴 Reducing Risk With Zero Trust 🕴
📖 Read
via "Dark Reading".
Zero trust isn’t just about authentication. Organizations can combine identity data with business awareness to address issues such as insider threat.📖 Read
via "Dark Reading".
Dark Reading
Reducing Risk With Zero Trust
Zero trust isn’t just about authentication. Organizations can combine identity data with business awareness to address issues such as insider threat.
🗓️ Jacuzzi customer details could be exposed by SmartTub web bugs, claims researcher 🗓️
📖 Read
via "The Daily Swig".
Iconic hot tub manufacturer addresses flaws that also apparently exposed numerous backend services📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Jacuzzi customer details could be exposed by SmartTub web bugs, claims researcher
Iconic hot tub manufacturer addresses flaws that also apparently exposed numerous backend services
🛠 OpenSSL Toolkit 1.1.1p 🛠
📖 Read
via "Packet Storm Security".
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.📖 Read
via "Packet Storm Security".
Packetstormsecurity
OpenSSL Toolkit 1.1.1p ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 Wireshark Analyzer 3.6.6 🛠
📖 Read
via "Packet Storm Security".
Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Wireshark Analyzer 3.6.6 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 BRATA Android Malware Evolves Into an APT 🕴
📖 Read
via "Dark Reading".
The BRATA Android banking Trojan is evolving into a persistent threat with a new phishing technique and event-logging capabilities.📖 Read
via "Dark Reading".
Dark Reading
BRATA Android Malware Evolves Into an APT
The BRATA Android banking Trojan is evolving into a persistent threat with a new phishing technique and event-logging capabilities.
🕴 Evolving Beyond the Password: It's Time to Up the Ante 🕴
📖 Read
via "Dark Reading".
While there's an immediate need to improve MFA adoption, it's also critical to move to more advanced and secure passwordless frameworks, including biometrics. (Part 1 of 2)📖 Read
via "Dark Reading".
Dark Reading
Evolving Beyond the Password: It's Time to Up the Ante
While there's an immediate need to improve MFA adoption, it's also critical to move to more advanced and secure passwordless frameworks, including biometrics. (Part 1 of 2)
❌ Modern IT Security Teams’ Inevitable Need for Advanced Vulnerability Management ❌
📖 Read
via "Threat Post".
Traditional vulnerability management programs are outdated, with little to no innovation in the last two decades. Today's dynamic IT environment demands an advanced vulnerability management program to deal with the complex attack surface and curb security risks.📖 Read
via "Threat Post".
Threat Post
Modern IT Security Teams’ Inevitable Need for Advanced Vulnerability Management
Today's modern attacks surface needs a reinvention in vulnerability management to deal with the rising cyberattacks.
⚠ Capital One identity theft hacker finally gets convicted ⚠
📖 Read
via "Naked Security".
It took three years, but the Capital One cracker was convicted in the end. Don't get caught out in a data breach of your own!📖 Read
via "Naked Security".
Naked Security
Capital One identity theft hacker finally gets convicted
It took three years, but the Capital One cracker was convicted in the end. Don’t get caught out in a data breach of your own!
‼ CVE-2022-1833 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has access to clusterwide edit rights by checking the secrets. The service account used for building the Operator gives more permission than expected and an attacker could benefit from it. This requires at least an already compromised low-privilege account or insider attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30874 ‼
📖 Read
via "National Vulnerability Database".
There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23342 ‼
📖 Read
via "National Vulnerability Database".
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the /mobilebroker/ServiceToBroker.svc/Json/Connect endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27870 ‼
📖 Read
via "National Vulnerability Database".
A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file. This vulnerability may be exploited to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32973 ‼
📖 Read
via "National Vulnerability Database".
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31786 ‼
📖 Read
via "National Vulnerability Database".
IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29774 ‼
📖 Read
via "National Vulnerability Database".
iSpyConnect iSpy v7.2.2.0 is vulnerable to path traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27869 ‼
📖 Read
via "National Vulnerability Database".
A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerability can be exploited to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27868 ‼
📖 Read
via "National Vulnerability Database".
A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.📖 Read
via "National Vulnerability Database".