‼ CVE-2020-28462 ‼
📖 Read
via "National Vulnerability Database".
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26307 ‼
📖 Read
via "National Vulnerability Database".
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34963 ‼
📖 Read
via "National Vulnerability Database".
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the News Feed module.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28459 ‼
📖 Read
via "National Vulnerability Database".
This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.📖 Read
via "National Vulnerability Database".
🛠 Logwatch 7.7 🛠
📖 Read
via "Packet Storm Security".
Logwatch analyzes and reports on unix system logs. It is a customizable and pluggable log monitoring system which will go through the logs for a given period of time and make a customizable report. It should work right out of the package on most systems.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Logwatch 7.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2020-28438 ‼
📖 Read
via "National Vulnerability Database".
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28445 ‼
📖 Read
via "National Vulnerability Database".
This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26306 ‼
📖 Read
via "National Vulnerability Database".
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34964 ‼
📖 Read
via "National Vulnerability Database".
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the SitePages module.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34961 ‼
📖 Read
via "National Vulnerability Database".
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Users Timeline module.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28422 ‼
📖 Read
via "National Vulnerability Database".
All versions of package git-archive are vulnerable to Command Injection via the exports function.📖 Read
via "National Vulnerability Database".
⚠ T-Mobile to cough up $500 million over 2021 data breach ⚠
📖 Read
via "Naked Security".
Technically, it's not a fine, and the lawyers will get a big chunk of it. But it still adds up to a half-billion-dollar data breach.📖 Read
via "Naked Security".
Naked Security
T-Mobile to cough up $500 million over 2021 data breach
Technically, it’s not a fine, and the lawyers will get a big chunk of it. But it still adds up to a half-billion-dollar data breach.
🕴 Qakbot Is Back With a New Trick: DLL Sideloading 🕴
📖 Read
via "Dark Reading".
In the latest iteration, Qakbot operators are using DLL sideloading to deliver malware, a technique that places legitimate and malicious files together in a common directory to avoid detection.📖 Read
via "Dark Reading".
Dark Reading
Qakbot Is Back With a New Trick: DLL Sideloading
In the latest iteration, Qakbot operators are using DLL sideloading to deliver malware, a technique that places legitimate and malicious files together in a common directory to avoid detection.
‼ CVE-2022-35650 ‼
📖 Read
via "National Vulnerability Database".
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35649 ‼
📖 Read
via "National Vulnerability Database".
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.📖 Read
via "National Vulnerability Database".
🤔1
‼ CVE-2022-35653 ‼
📖 Read
via "National Vulnerability Database".
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24083 ‼
📖 Read
via "National Vulnerability Database".
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35652 ‼
📖 Read
via "National Vulnerability Database".
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35651 ‼
📖 Read
via "National Vulnerability Database".
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34965 ‼
📖 Read
via "National Vulnerability Database".
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.📖 Read
via "National Vulnerability Database".
🕴 Why Layer 8 Is Great 🕴
📖 Read
via "Dark Reading".
To help discern legitimate traffic from fraud, it helps to understand user intent as shown through their behavior.📖 Read
via "Dark Reading".
Dark Reading
Why Layer 8 Is Great
To help discern legitimate traffic from fraud, it helps to understand user intent as shown through their behavior.