‼ CVE-2022-28877 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalation on affected F-Secure & WithSecure windows endpoint products. An attacker must have code execution rights on the victim machine prior to successful exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36313 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28860 ‼
📖 Read
via "National Vulnerability Database".
An authentication downgrade in the server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to achieve HTTP access to the camera.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0902 ‼
📖 Read
via "National Vulnerability Database".
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28861 ‼
📖 Read
via "National Vulnerability Database".
The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35899 ‼
📖 Read
via "National Vulnerability Database".
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-30628 ‼
📖 Read
via "National Vulnerability Database".
It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28666 ‼
📖 Read
via "National Vulnerability Database".
Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32430 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34767 ‼
📖 Read
via "National Vulnerability Database".
Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user's identity and can be accessed publicly.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32289 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30337 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings.📖 Read
via "National Vulnerability Database".
🕴 Google Becomes First Cloud Operator to Join Healthcare ISAC 🕴
📖 Read
via "Dark Reading".
Google Cloud pledges experts and other resources to Health Information Sharing and Analysis Center, a community of healthcare infrastructure operators and owners.📖 Read
via "Dark Reading".
Dark Reading
Google Becomes First Cloud Operator to Join Healthcare ISAC
Google Cloud pledges experts and other resources to Health Information Sharing and Analysis Center, a community of healthcare infrastructure operators and owners.
🕴 Equitable Digital Identity Verification Requires Moving Past Flawed Legacy Systems 🕴
📖 Read
via "Dark Reading".
Data science can be used to improve access to government assistance while reducing fraud.📖 Read
via "Dark Reading".
Dark Reading
Equitable Digital Identity Verification Requires Moving Past Flawed Legacy Systems
Data science can be used to improve access to government assistance while reducing fraud.
‼ CVE-2022-34487 ‼
📖 Read
via "National Vulnerability Database".
Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33198 ‼
📖 Read
via "National Vulnerability Database".
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28700 ‼
📖 Read
via "National Vulnerability Database".
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30536 ‼
📖 Read
via "National Vulnerability Database".
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31475 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.📖 Read
via "National Vulnerability Database".
🛠 AIEngine 2.2.0 🛠
📖 Read
via "Packet Storm Security".
AIEngine is a packet inspection engine with capabilities of learning without any human intervention. It helps network/security professionals to identify traffic and develop signatures for use them on NIDS, Firewalls, Traffic classifiers and so on.📖 Read
via "Packet Storm Security".
Packetstormsecurity
AIEngine 2.2.0 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 Mysterious, Cloud-Enabled macOS Spyware Blows Onto the Scene 🕴
📖 Read
via "Dark Reading".
The CloudMensis spyware, which can lift reams of sensitive information from Apple machines, is the first Mac malware observed to exclusively rely on cloud storage for C2 activities.📖 Read
via "Dark Reading".
Dark Reading
Mysterious, Cloud-Enabled macOS Spyware Blows Onto the Scene
The CloudMensis spyware, which can lift reams of sensitive information from Apple machines, is the first Mac malware observed to exclusively rely on cloud storage for C2 activities.