‼ CVE-2020-14127 ‼
📖 Read
via "National Vulnerability Database".
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32225 ‼
📖 Read
via "National Vulnerability Database".
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2393 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32213 ‼
📖 Read
via "National Vulnerability Database".
The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30024 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the System Tools of the Wi-Fi network. This affects TL-WR841 V12 TL-WR841N(EU)_V12_160624 and TL-WR841 V11 TL-WR841N(EU)_V11_160325 , TL-WR841N_V11_150616 and TL-WR841 V10 TL-WR841N_V10_150310 are also affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32212 ‼
📖 Read
via "National Vulnerability Database".
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.📖 Read
via "National Vulnerability Database".
⚠ S3 Ep91: CodeRed, OpenSSL, Java bugs and Office macros [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.📖 Read
via "Naked Security".
Naked Security
S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]
Latest episode – listen now! Great discussion, technical content, solid advice… all covered in plain English.
‼ CVE-2021-39016 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. IBM X-Force ID: 213722.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39015 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39028 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 213866.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22473 ‼
📖 Read
via "National Vulnerability Database".
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID: 225347.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39019 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39017 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 213725.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22477 ‼
📖 Read
via "National Vulnerability Database".
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 225605.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35283 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP request.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39018 ‼
📖 Read
via "National Vulnerability Database".
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system. IBM X-Force ID: 213726.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45492 ‼
📖 Read
via "National Vulnerability Database".
In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory. Note that while older versions of the software default to installing in %PROGRAMFILES(X86)% (which would allow the Sage folder to inherit strong permissions, making the installation not vulnerable), the official Sage 300 installation guides for those versions recommend installing in C:\Sage, which would make the installation vulnerable.📖 Read
via "National Vulnerability Database".
🕴 Data of Nearly 2M Patients Exposed in Ransomware Attack on Healthcare Debt Collection Firm 🕴
📖 Read
via "Dark Reading".
Professional Finance Company (PFC) was hit in February 2022 by a ransomware attack.📖 Read
via "Dark Reading".
Dark Reading
Data of Nearly 2M Patients Exposed in Ransomware Attack on Healthcare Debt Collection Firm
Professional Finance Company (PFC) was hit in February 2022 by a ransomware attack.
🕴 Scribe Security Releases Code Integrity Validator Alongside Github Security Open Source Project 🕴
📖 Read
via "Dark Reading".
Developers can now rest assured that the code they are using, as well as their GitHub accounts, are safe.📖 Read
via "Dark Reading".
Dark Reading
Scribe Security Releases Code Integrity Validator Alongside Github Security Open Source Project
Developers can now rest assured that the code they are using, as well as their GitHub accounts, are safe.
🕴 AEI HorizonX Ventures Joins Shift5 Series B Funding Round 🕴
📖 Read
via "Dark Reading".
Investment bolsters Shift5’s traction within commercial aerospace and defense industries.📖 Read
via "Dark Reading".
Dark Reading
AEI HorizonX Ventures Joins Shift5 Series B Funding Round
Investment bolsters Shift5’s traction within commercial aerospace and defense industries.
‼ CVE-2022-2408 ‼
📖 Read
via "National Vulnerability Database".
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.📖 Read
via "National Vulnerability Database".