πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-33315 β€Ό

Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33318 β€Ό

Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64 server.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29834 β€Ό

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS GENESIS64 versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 mobile monitoring application and accessing the monitoring screen.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1264 β€Ό

The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-34045 β€Ό

Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-34046 β€Ό

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-34150 β€Ό

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33320 β€Ό

Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1766 β€Ό

Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33317 β€Ό

Inclusion of Functionality from Untrusted Control Sphere vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-2107 β€Ό

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS ownerÒ€ℒs mobile number.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33319 β€Ό

Out-of-bounds Read vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64 server.

πŸ“– Read

via "National Vulnerability Database".
πŸ” What is SIEM? How It Works, Best Practices for Implementation & More πŸ”

Learn about Security Information and Event Management or SIEM, how an organization can get the most out of its SIEM technology and best practices for implementing a solution in this blog.

πŸ“– Read

via "".
πŸ•΄ Mutare Voice Network Threat Survey Shows Nearly Half of Organizations Experienced Vishing or Social Engineering Attacks in Past Year πŸ•΄

Unsecured voice traffic, skyrocketing adoption of Teams-centric enterprise collaboration tools widen enterprise cybersecurity gaps and increase risk of breach.

πŸ“– Read

via "Dark Reading".
πŸ•΄ What InfoSec Pros Can Teach the Organization About ESG πŸ•΄

Security pros' experience with transparency and evaluating third-party partners positions them to act as key environmental, social, and governance advisers.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Data-Centric Security Market Worth $12.3B by 2027 - Exclusive Report by MarketsandMarketsβ„’ πŸ•΄

.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Feds Recoup $500K From Maui Ransomware Gang πŸ•΄

Law enforcement hopes that retuning ransom payments to impacted businesses will demonstrate that working with the feds following a cybersecurity breach is "good business."

πŸ“– Read

via "Dark Reading".
πŸ•΄ Lax Security Fuels Massive 8220 Gang Botnet Army Surge πŸ•΄

The threat group 8220 Gang's cryptocurrency miner and botnet reach has exploded to 30,000 global hosts, a notable increase over the past month, researchers say.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 'AIG' Threat Group Launches with Unique Business Model πŸ•΄

The rapidly growing Atlas Intelligence Group relies on cyber-mercenaries to carry out its missions.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-29454 β€Ό

Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-38936 β€Ό

IBM QRadar SIEM 7.3, 7.4, and 7.5 could disclose highly sensitive information to a privileged user. IBM X-Force ID: 210893.

πŸ“– Read

via "National Vulnerability Database".