‼ CVE-2022-2698 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in SourceCodester Simple E-Learning System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument searchPost leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205819.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2700 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in SourceCodester Gym Management System. This affects an unknown part of the component GET Parameter Handler. The manipulation of the argument day leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205821 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 HYAS Infosec Announces General Availability of Cybersecurity Solution for Production Environments 🕴
📖 Read
via "Dark Reading".
HYAS Confront provides total visibility into your production environment, giving you insight into potential issues like cyber threats before they become problems.📖 Read
via "Dark Reading".
Dark Reading
HYAS Infosec Announces General Availability of Cybersecurity Solution for Production Environments
HYAS Confront provides total visibility into your production environment, giving you insight into potential issues like cyber threats before they become problems.
🕴 We Have the Tech to Scale Up Open Source Vulnerability Fixes — Now It's Time to Leverage It 🕴
📖 Read
via "Dark Reading".
Q&A with Jonathan Leitschuh, inaugural HUMAN Dan Kaminsky Fellow, in advance of his upcoming Black Hat USA presentation.📖 Read
via "Dark Reading".
Dark Reading
We Have the Tech to Scale Up Open Source Vulnerability Fixes — Now It's Time to Leverage It
Q&A with Jonathan Leitschuh, inaugural HUMAN Dan Kaminsky Fellow, in advance of his upcoming Black Hat USA presentation.
⚠ Slack admits to leaking hashed passwords for three months ⚠
📖 Read
via "Naked Security".
"When those invitations went out... somehow, your password hash went out with them."📖 Read
via "Naked Security".
Naked Security
Slack admits to leaking hashed passwords for five years
“When those invitations went out… somehow, your password hash went out with them.”
👍1👏1
❌ Phishers Swim Around 2FA in Coinbase Account Heists ❌
📖 Read
via "Threat Post".
Attackers are spoofing the widely used cryptocurrency exchange to trick users into logging in so they can steal their credentials and eventually their funds.📖 Read
via "Threat Post".
Threat Post
Phishers Swim Around 2FA in Coinbase Account Heists
Attackers are spoofing the widely used cryptocurrency exchange to trick users into logging in so they can steal their credentials and eventually their funds.
🕴 Deepfakes Grow in Sophistication, Cyberattacks Rise Following Ukraine War 🕴
📖 Read
via "Dark Reading".
A rising tide of threats — from API exploits to deepfakes to extortionary ransomware attacks — is threatening to overwhelm IT security teams.📖 Read
via "Dark Reading".
Dark Reading
Deepfakes Grow in Sophistication, Cyberattacks Rise Following Ukraine War
A rising tide of threats — from API exploits to deepfakes to extortionary ransomware attacks — is threatening to overwhelm IT security teams.
‼ CVE-2022-2424 ‼
📖 Read
via "National Vulnerability Database".
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36266 ‼
📖 Read
via "National Vulnerability Database".
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35490 ‼
📖 Read
via "National Vulnerability Database".
Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker might work around this prevention, enabling them to send more than the configured amount of requests before the user invalidation takes place.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2386 ‼
📖 Read
via "National Vulnerability Database".
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2713 ‼
📖 Read
via "National Vulnerability Database".
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35487 ‼
📖 Read
via "National Vulnerability Database".
Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2409 ‼
📖 Read
via "National Vulnerability Database".
The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36265 ‼
📖 Read
via "National Vulnerability Database".
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page. After performing a reverse engineering of the firmware, it was discovered that a hidden page not listed in the administration management interface allows a user to execute Linux commands on the device with root privileges. An authenticated malicious threat actor can use this page to fully compromise the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2395 ‼
📖 Read
via "National Vulnerability Database".
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2356 ‼
📖 Read
via "National Vulnerability Database".
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1323 ‼
📖 Read
via "National Vulnerability Database".
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36267 ‼
📖 Read
via "National Vulnerability Database".
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2367 ‼
📖 Read
via "National Vulnerability Database".
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2269 ‼
📖 Read
via "National Vulnerability Database".
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection📖 Read
via "National Vulnerability Database".