🗓️ Oracle patches ‘miracle exploit’ impacting Middleware Fusion, cloud services 🗓️
📖 Read
via "The Daily Swig".
Researchers describe discovery of ‘mega’ zero-day📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Oracle patches ‘miracle exploit’ impacting Middleware Fusion, cloud services
Researchers describe discovery of ‘mega’ zero-day
🕴 It's a Race to Secure the Software Supply Chain — Have You Already Stumbled? 🕴
📖 Read
via "Dark Reading".
If you haven't properly addressed the issue, you're already behind. But even if you've had a false start, it's never too late to get back up.📖 Read
via "Dark Reading".
Dark Reading
It's a Race to Secure the Software Supply Chain — Have You Already Stumbled?
If you haven't properly addressed the issue, you're already behind. But even if you've had a false start, it's never too late to get back up.
⚠ OpenSSL issues a bugfix for the previous bugfix ⚠
📖 Read
via "Naked Security".
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.📖 Read
via "Naked Security".
Naked Security
OpenSSL issues a bugfix for the previous bugfix
Fortunately, it’s not a major bugfix, which means it’s easy to patch and can teach us all some useful lessons.
‼ CVE-2021-40900 ‼
📖 Read
via "National Vulnerability Database".
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40901 ‼
📖 Read
via "National Vulnerability Database".
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2218 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2216 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2208 ‼
📖 Read
via "National Vulnerability Database".
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2207 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
🕴 Thrive Acquires DSM 🕴
📖 Read
via "Dark Reading".
DSM is now the third acquisition by Thrive in Florida in the past six months.📖 Read
via "Dark Reading".
Dark Reading
Thrive Acquires DSM
DSM is now the third acquisition by Thrive in Florida in the past six months.
⚠ FTC warns of LGBTQ+ extortion scams – be aware before you share! ⚠
📖 Read
via "Naked Security".
It's a simple jingle and it's solid advice: "If in doubt, don't give it out!"📖 Read
via "Naked Security".
Naked Security
FTC warns of LGBTQ+ extortion scams – be aware before you share!
It’s a simple jingle and it’s solid advice: “If in doubt, don’t give it out!”
🗓️ Untrusted types: Researcher demos trick to beat Trusted Types protection in Google Chrome 🗓️
📖 Read
via "The Daily Swig".
Flaws in protection mechanism leaves websites more exposed to DOM XSS-based attacks📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Untrusted types: Researcher demos trick to beat Trusted Types protection in Google Chrome
Flaws in protection mechanism leaves websites more exposed to DOM XSS-based attacks
‼ CVE-2017-20101 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-20100 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21161 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-20102 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
🗓️ Researchers crack MEGA’s ‘privacy by design’ storage, encryption 🗓️
📖 Read
via "The Daily Swig".
ETH Zurich finds flaws in the firm’s cryptographic infrastructure📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Researchers crack MEGA’s ‘privacy by design’ storage, encryption
ETH Zurich finds flaws in the firm’s cryptographic infrastructure
⚠ Harmony blockchain loses nearly $100M due to hacked private keys ⚠
📖 Read
via "Naked Security".
The crooks needed at least two private keys, each stored in two parts... but they got them anyway.📖 Read
via "Naked Security".
Naked Security
Harmony blockchain loses nearly $100M due to hacked private keys
The crooks needed at least two private keys, each stored in two parts… but they got them anyway.
‼ CVE-2022-2140 ‼
📖 Read
via "National Vulnerability Database".
Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33650 ‼
📖 Read
via "National Vulnerability Database".
When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds of inputs which allocated from heap buffers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2106 ‼
📖 Read
via "National Vulnerability Database".
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.📖 Read
via "National Vulnerability Database".