‼ CVE-2022-36950 ‼
📖 Read
via "National Vulnerability Database".
In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipulation. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36948 ‼
📖 Read
via "National Vulnerability Database".
In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42537 ‼
📖 Read
via "National Vulnerability Database".
VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42535 ‼
📖 Read
via "National Vulnerability Database".
VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36955 ‼
📖 Read
via "National Vulnerability Database".
In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1.📖 Read
via "National Vulnerability Database".
🕴 Overcoming the Fail-to-Challenge Vulnerability With a Friendly Face 🕴
📖 Read
via "Dark Reading".
Ahead of their Black Hat USA talk in August, Simon Pavitt and Stephen Dewsnip explain the value of helping people practice cyber defense via a "malicious floorwalker" exercise.📖 Read
via "Dark Reading".
Dark Reading
Overcoming the Fail-to-Challenge Vulnerability With a Friendly Face
Ahead of their Black Hat USA talk in August, Simon Pavitt and Stephen Dewsnip explain the value of helping people practice cyber defense via a "malicious floorwalker" exercise.
‼ CVE-2022-1861 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1853 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1865 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1873 ‼
📖 Read
via "National Vulnerability Database".
Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1862 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass profile restrictions via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1874 ‼
📖 Read
via "National Vulnerability Database".
Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1866 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific user interactions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1858 ‼
📖 Read
via "National Vulnerability Database".
Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via specific user interaction.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1860 ‼
📖 Read
via "National Vulnerability Database".
Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user interactions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1868 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46830 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could potentially allow an external user who self-registers with a specific username and/or profile information to gain access to files at a higher directory level than intended.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1871 ‼
📖 Read
via "National Vulnerability Database".
Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1876 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1870 ‼
📖 Read
via "National Vulnerability Database".
Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.📖 Read
via "National Vulnerability Database".