‼ CVE-2020-25586 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2047 ‼
📖 Read
via "National Vulnerability Database".
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25590 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19158 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19153 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19157 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25591 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29281 ‼
📖 Read
via "National Vulnerability Database".
File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27732 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41042 ‼
📖 Read
via "National Vulnerability Database".
In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-19155 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.📖 Read
via "National Vulnerability Database".
👍1
⚠ S3 Ep90: Chrome 0-day again, True Cybercrime, and a 2FA bypass [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Listen now! Or read if you prefer...📖 Read
via "Naked Security".
Naked Security
S3 Ep90: Chrome 0-day, cybercrime, 2FA bypass [Audio + Text]
Listen now! Or read if you prefer…
⚠ Apache “Commons Configuration” toolkit patches Log4Shell-like bug ⚠
📖 Read
via "Naked Security".
It's a bit like Log4J, but for configuration files, not for logging.📖 Read
via "Naked Security".
Naked Security
Apache “Commons Configuration” patches Log4Shell-style bug – what you need to know
It’s a bit like Log4J, but for configuration files, not for logging.
‼ CVE-2022-1245 ‼
📖 Read
via "National Vulnerability Database".
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41037 ‼
📖 Read
via "National Vulnerability Database".
In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.📖 Read
via "National Vulnerability Database".
❌ U.S. Healthcare Orgs Targeted with Maui Ransomware ❌
📖 Read
via "Threat Post".
State-sponsored actors are deploying the unique malware--which targets specific files and leaves no ransomware note--in ongoing attacks.📖 Read
via "Threat Post".
Threat Post
U.S. Healthcare Orgs Targeted with Maui Ransomware
State-sponsored actors are deploying the unique malware–which targets specific files and leaves no ransomware note–in ongoing attacks.
🕴 ICYMI: Critical Cisco RCE Bug, Microsoft Breaks Down Hive, SHI Cyberattack 🕴
📖 Read
via "Dark Reading".
Dark Reading's digest of the other don't-miss stories of the week, including a new ransomware targeting QNAP gear, and a destructive attack against the College of the Desert that lingers on.📖 Read
via "Dark Reading".
Dark Reading
ICYMI: Critical Cisco RCE Bug, Microsoft Breaks Down Hive, SHI Cyberattack
Dark Reading's digest of the other don't-miss stories of the week, including a new ransomware targeting QNAP gear, and a destructive attack against the College of the Desert that lingers on.
🕴 What Do All of Those Cloud Cybersecurity Acronyms Mean? 🕴
📖 Read
via "Dark Reading".
Acronyms serve as a gatekeeper — if you don't sling the lingo, you don't belong. So here's a quick guide to the letter salad of cloud cybersecurity.📖 Read
via "Dark Reading".
Dark Reading
What Do All of Those Cloud Cybersecurity Acronyms Mean?
Acronyms serve as a gatekeeper — if you don't sling the lingo, you don't belong. So here's a quick guide to the letter salad of cloud cybersecurity.
‼ CVE-2022-31290 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28624 ‼
📖 Read
via "National Vulnerability Database".
A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited to allow cross site scripting (XSS). HPE has made the following software updates to resolve the vulnerability. HPE FlexNetwork 5130EL_7.10.R3507P02 and HPE FlexFabric 5945_7.10.R6635.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32115 ‼
📖 Read
via "National Vulnerability Database".
An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file.📖 Read
via "National Vulnerability Database".
👍1