🕴 Rare 'CosmicStrand' UEFI Rootkit Swings into Cybercrime Orbit 🕴
📖 Read
via "Dark Reading".
The firmware threat offers ultimate stealth and persistence — and may be distributed via tainted firmware components in a supply chain play, researchers theorize.📖 Read
via "Dark Reading".
Dark Reading
Rare 'CosmicStrand' UEFI Rootkit Swings into Cybercrime Orbit
The firmware threat offers ultimate stealth and persistence — and may be distributed via tainted firmware components in a supply chain play, researchers theorize.
‼ CVE-2022-34907 ‼
📖 Read
via "National Vulnerability Database".
An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain access to the system with the highest authority possible and gain full control over the FileWave platform.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34906 ‼
📖 Read
via "National Vulnerability Database".
A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensitive information saved in FileWave, and even send crafted requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35131 ‼
📖 Read
via "National Vulnerability Database".
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36375 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2020-36290 ‼
📖 Read
via "National Vulnerability Database".
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22686 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.📖 Read
via "National Vulnerability Database".
🗓️ Cloud fax company claims healthcare pros are ditching email for ‘more secure’ fax 🗓️
📖 Read
via "The Daily Swig".
The fax is dead. Long live the online fax? A new study suggests many healthcare professionals believe that flaws in today’s web security landscape are prompting a return to what’s been deemed an “extr📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Cloud fax company claims healthcare pros are ditching email for ‘more secure’ fax
The fax is dead. Long live the online fax?
❌ IoT Botnets Fuels DDoS Attacks – Are You Prepared? ❌
📖 Read
via "Threat Post".
The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. This is a dangerous warning that the possibility of a sophisticated DDoS attack and a prolonged service outage will prevent businesses from growing.📖 Read
via "Threat Post".
Threat Post
IoT Botnets Fuels DDoS Attacks – Are You Prepared?
The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. Learn more.
❌ Phishing Attacks Skyrocket with Microsoft and Facebook as Most Abused Brands ❌
📖 Read
via "Threat Post".
Instances of phishing attacks leveraging the Microsoft brand increased 266 percent in Q1 compared to the year prior.📖 Read
via "Threat Post".
Threat Post
Phishing Attacks Skyrocket with Microsoft and Facebook as Most Abused Brands
Instances of phishing attacks leveraging the Microsoft brand increased 266 percent in Q1 compared to the year prior.
👏1
🗓️ Critical security vulnerability in Grails could lead to remote code execution 🗓️
📖 Read
via "The Daily Swig".
Maintainers warn to patch all versions of open source web app framework – even those not deemed vulnerable📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Critical security vulnerability in Grails could lead to remote code execution
Maintainers warn to patch all versions of open source web app framework – even those not deemed vulnerable
🕴 The Beautiful Lies of Machine Learning in Security 🕴
📖 Read
via "Dark Reading".
Machine learning should be considered an extension of — not a replacement for — existing security methods, systems, and teams.📖 Read
via "Dark Reading".
Dark Reading
The Beautiful Lies of Machine Learning in Security
Machine learning should be considered an extension of — not a replacement for — existing security methods, systems, and teams.
🕴 Siemens Energy Takes Next Step to Protect Critical Infrastructure 🕴
📖 Read
via "Dark Reading".
Company joins AWS Partner Network to provide customers with industrial cybersecurity solution to ensure reliable electricity and fuel supplies.📖 Read
via "Dark Reading".
Dark Reading
Siemens Energy Takes Next Step to Protect Critical Infrastructure
Company joins AWS Partner Network to provide customers with industrial cybersecurity solution to ensure reliable electricity and fuel supplies.
‼ CVE-2021-33457 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33745 ‼
📖 Read
via "National Vulnerability Database".
insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / value between old and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition, omitting flushes where such are necessary.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33460 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33451 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33440 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36161 ‼
📖 Read
via "National Vulnerability Database".
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33461 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33464 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c.📖 Read
via "National Vulnerability Database".