‼ CVE-2022-26427 ‼
📖 Read
via "National Vulnerability Database".
In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085540; Issue ID: ALPS07085540.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2598 ‼
📖 Read
via "National Vulnerability Database".
Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21788 ‼
📖 Read
via "National Vulnerability Database".
In scp, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06988728; Issue ID: ALPS06988728.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2581 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26439 ‼
📖 Read
via "National Vulnerability Database".
In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20220420020; Issue ID: GN20220420020.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26435 ‼
📖 Read
via "National Vulnerability Database".
In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138435; Issue ID: ALPS07138435.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21790 ‼
📖 Read
via "National Vulnerability Database".
In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479306; Issue ID: ALPS06479306.📖 Read
via "National Vulnerability Database".
âš GnuTLS patches memory mismanagement bug – update now! âš
📖 Read
via "Naked Security".
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 Name That Edge Toon: Up a Tree 🕴
📖 Read
via "Dark Reading".
Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.📖 Read
via "Dark Reading".
Dark Reading
Name That Edge Toon: Up a Tree
Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.
🕴 Chromium Browsers Allow Data Exfiltration via Bookmark Syncing 🕴
📖 Read
via "Dark Reading".
"Bruggling" emerges as a novel technique for pilfering data out from a compromised environment — or for sneaking in malicious code and attack tools.📖 Read
via "Dark Reading".
Dark Reading
Chromium Browsers Allow Data Exfiltration via Bookmark Syncing
"Bruggling" emerges as a novel technique for pilfering data out from a compromised environment — or for sneaking in malicious code and attack tools.
‼ CVE-2022-34307 ‼
📖 Read
via "National Vulnerability Database".
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34161 ‼
📖 Read
via "National Vulnerability Database".
IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 229331.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33955 ‼
📖 Read
via "National Vulnerability Database".
IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. IBM X-Force ID: 229312.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34162 ‼
📖 Read
via "National Vulnerability Database".
IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 229332.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31109 ‼
📖 Read
via "National Vulnerability Database".
laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by default, and require users to opt-in to `X-Forwarded-*` header usage via a configured `Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject `X-Forwarded-*` headers at the web server level.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31148 ‼
📖 Read
via "National Vulnerability Database".
Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34164 ‼
📖 Read
via "National Vulnerability Database".
IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation. IBM X-Force ID: 229338.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34163 ‼
📖 Read
via "National Vulnerability Database".
IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229333.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31128 ‼
📖 Read
via "National Vulnerability Database".
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify permissions when creating branches with the REST API in Git repositories using the fine grained permissions. Users can create branches via the REST endpoint `POST git/:id/branches` regardless of the permissions set on the repository. This issue has been fixed in version 13.10.99.82 Tuleap Community Edition as well as in version 13.10-3 of Tuleap Enterprise Edition. Users are advised to upgrade. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
🕴 Credential Canaries Create Minefield for Attackers 🕴
📖 Read
via "Dark Reading".
Canary tokens — also known as honey tokens — force attackers to second-guess their potential good fortune when they come across user and application secrets.📖 Read
via "Dark Reading".
Dark Reading
Credential Canaries Create Minefield for Attackers
Canary tokens — also known as honey tokens — force attackers to second-guess their potential good fortune when they come across user and application secrets.
🕴 Ransomware Hit on European Pipeline & Energy Supplier Encevo Linked to BlackCat 🕴
📖 Read
via "Dark Reading".
Customers across several European countries are urged to update credentials in the wake of the attack that affected a gas-pipeline operator and power company.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Hit on European Pipeline & Energy Supplier Encevo Linked to BlackCat
Customers across several European countries are urged to update credentials in the wake of the attack that affected a gas-pipeline operator and power company.