‼ CVE-2022-34871 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of poller resources. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-16335.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35864 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34872 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of Virtual Metrics. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16336.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31197 ‼
📖 Read
via "National Vulnerability Database".
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34992 ‼
📖 Read
via "National Vulnerability Database".
Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31175 ‼
📖 Read
via "National Vulnerability Database".
CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `<textarea>` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
🕴 Critical RCE Bug in DrayTek Routers Opens SMBs to Zero-Click Attacks 🕴
📖 Read
via "Dark Reading".
SMBs should patch CVE-2022-32548 now to avoid a host of horrors, including complete network compromise, ransomware, state-sponsored attacks, and more.📖 Read
via "Dark Reading".
Dark Reading
Critical RCE Bug in DrayTek Routers Opens SMBs to Zero-Click Attacks
SMBs should patch CVE-2022-32548 now to avoid a host of horrors, including complete network compromise, ransomware, state-sponsored attacks, and more.
👍1
🔏 NYDFS Proposes New Changes to Its Cybersecurity Rules 🔏
📖 Read
via "".
Recently proposed amendments to the NYDFS Cybersecurity Regulation would demand new technological enhancements, audit and risk assessment requirements of companies.📖 Read
via "".
🕴 How IT Teams Can Use 'Harm Reduction' for Better Cybersecurity Outcomes 🕴
📖 Read
via "Dark Reading".
Copado's Kyle Tobener will discuss a three-pronged plan at Black Hat USA for addressing human weaknesses in cybersecurity with this medical concept — from phishing to shadow IT.📖 Read
via "Dark Reading".
Dark Reading
How IT Teams Can Use 'Harm Reduction' for Better Cybersecurity Outcomes
Copado's Kyle Tobener will discuss a three-pronged plan at Black Hat USA for addressing human weaknesses in cybersecurity with this medical concept — from phishing to shadow IT.
👍1🤯1
‼ CVE-2022-35506 ‼
📖 Read
via "National Vulnerability Database".
TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of program parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43178 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35158 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35928 ‼
📖 Read
via "National Vulnerability Database".
AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checked before being read. This vulnerability may lead to buffer overruns. This does _not_ affect source code found on aescrypt.com, nor is the vulnerability present when providing a password or a key via the `-p` or `-k` command-line options. The problem was fixed via in commit 68761851b and will be included in release 3.16. Users are advised to upgrade. Users unable to upgrade should us the `-p` or `-k` options to provide a password or key.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35505 ‼
📖 Read
via "National Vulnerability Database".
A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the length of the output of the executed command.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43179 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35161 ‼
📖 Read
via "National Vulnerability Database".
GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27551 ‼
📖 Read
via "National Vulnerability Database".
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.📖 Read
via "National Vulnerability Database".
⚠ GitHub blighted by “researcher” who created thousands of malicious projects ⚠
📖 Read
via "Naked Security".
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 New Startup Footprint Tackles Identity Verification 🕴
📖 Read
via "Dark Reading".
Early-stage startup Footprint's goal is to provide tools that change how enterprises verify, authentication, authorize, and secure identity.📖 Read
via "Dark Reading".
Dark Reading
Startup Footprint Tackles Identity Verification
Early-stage startup Footprint's goal is to provide tools that change how enterprises verify, authentication, authorize, and secure identity.
📢 Norton and Avast merger 'provisionally' approved by UK regulator 📢
📖 Read
via "ITPro".
Competition and Markets Authority investigation suggests new software giant would still face "significant" competition📖 Read
via "ITPro".
IT PRO
Norton and Avast merger 'provisionally' approved by UK regulator | IT PRO
Competition and Markets Authority investigation suggests new software giant would still face "significant" competition
📢 T-Mobile ‘social engineer’ store owner ran $25 million black market operation 📢
📖 Read
via "ITPro".
The five-year campaign saw the former owner defraud the company after stealing more than 50 employees' login credentials📖 Read
via "ITPro".
IT PRO
T-Mobile ‘social engineer’ store owner ran $25 million black market operation | IT PRO
The five-year campaign saw the former owner defraud the company after stealing more than 50 employees' login credentials
👍1