⚠ S3 Ep92: Log4Shell4Ever, travel tips, and scamminess [Audio + Text] ⚠
📖 Read
via "Naked Security".
Latest episode - listen, read or both!📖 Read
via "Naked Security".
Naked Security
S3 Ep92: Log4Shell4Ever, travel tips, and scamminess [Audio + Text]
Latest episode – listen, read or both!
⚠ Apple patches “0-day” browser bug fixed 2 weeks ago in Chrome, Edge ⚠
📖 Read
via "Naked Security".
One vendor's zero-day is another vendor's routine patch...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🗓️ Zyxel firewall vulnerabilities left business networks open to abuse 🗓️
📖 Read
via "The Daily Swig".
Severity of code execution bug mitigated by ‘high uptake’ of previous patch📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Zyxel firewall vulnerabilities left business networks open to abuse
Severity of code execution bug mitigated by ‘high uptake’ of previous patch
‼ CVE-2022-36131 ‼
📖 Read
via "National Vulnerability Database".
The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31168 ‼
📖 Read
via "National Vulnerability Database".
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.📖 Read
via "National Vulnerability Database".
🕴 What Firewalls Can — and Can't — Accomplish 🕴
📖 Read
via "Dark Reading".
Understanding the limitations of firewalls is important to protecting the organization from evolving threats.📖 Read
via "Dark Reading".
Dark Reading
What Firewalls Can — and Can't — Accomplish
Understanding the limitations of firewalls is important to protecting the organization from evolving threats.
🔏 Friday Five 7/22 🔏
📖 Read
via "".
A new PayPal phishing campaign makes the rounds, the FBI sounds the alarm on fake cryptocurrency apps, and more - catch up on the news of the week with the Friday Five!📖 Read
via "".
🗓️ ‘We’re still fighting last decade’s battle’ – Sonatype CTO Brian Fox on the struggle to secure the neglected software supply chain 🗓️
📖 Read
via "The Daily Swig".
Open source security expert warns there is still a ‘long road’ ahead to prepare for the next attack wave📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
‘We’re still fighting last decade’s battle’ – Sonatype CTO Brian Fox on the struggle to secure the neglected software supply chain
Open source security expert warns there is still a ‘long road’ ahead to prepare for the next attack wave
‼ CVE-2022-34509 ‼
📖 Read
via "National Vulnerability Database".
The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34037 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-2136 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34982 ‼
📖 Read
via "National Vulnerability Database".
The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2135 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36200 ‼
📖 Read
via "National Vulnerability Database".
Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2142 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2143 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34520 ‼
📖 Read
via "National Vulnerability Database".
Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c. This vulnerability allows attackers to cause a Denial of Service (DOS) via a crafted binary file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34502 ‼
📖 Read
via "National Vulnerability Database".
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34501 ‼
📖 Read
via "National Vulnerability Database".
The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2470 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2137 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information📖 Read
via "National Vulnerability Database".