‼ CVE-2022-38511 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-36573 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36615 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36613 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36610 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38510 ‼
📖 Read
via "National Vulnerability Database".
Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36614 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36611 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34668 ‼
📖 Read
via "National Vulnerability Database".
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36616 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36612 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36572 ‼
📖 Read
via "National Vulnerability Database".
Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/deal/.📖 Read
via "National Vulnerability Database".
🕴 The 3 Questions CISOs Must Ask to Protect Their Sensitive Data 🕴
📖 Read
via "Dark Reading".
CISOs must adopt a new mindset to take on the moving targets in modern cybersecurity.📖 Read
via "Dark Reading".
Dark Reading
The 3 Questions CISOs Must Ask to Protect Their Sensitive Data
CISOs must adopt a new mindset to take on the moving targets in modern cybersecurity.
‼ CVE-2022-37059 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field📖 Read
via "National Vulnerability Database".
❌ Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms ❌
📖 Read
via "Threat Post".
Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.📖 Read
via "Threat Post".
Threat Post
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.
🕴 NATO Investigates Dark Web Leak of Data Stolen from Missile Vendor 🕴
📖 Read
via "Dark Reading".
Documents allegedly belonging to an EU defense dealer include those relating to weapons used by Ukraine in its fight against Russia.📖 Read
via "Dark Reading".
Dark Reading
NATO Investigates Dark Web Leak of Data Stolen From Missile Vendor
Documents allegedly belonging to an EU defense dealer include those relating to weapons used by Ukraine in its fight against Russia.
🕴 Cyber-Insurance Firms Limit Payouts, Risk Obsolescence 🕴
📖 Read
via "Dark Reading".
Businesses need to re-evaluate their cyber-insurance policies as firms like Lloyd's of London continue to add restrictions, including excluding losses related to state-backed cyberattackers.📖 Read
via "Dark Reading".
Dark Reading
Cyber-Insurance Firms Limit Payouts, Risk Obsolescence
Businesses need to re-evaluate their cyber-insurance policies as firms like Lloyd's of London continue to add restrictions, including excluding losses related to state-backed cyberattackers.
‼ CVE-2022-0284 ‼
📖 Read
via "National Vulnerability Database".
A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0496 ‼
📖 Read
via "National Vulnerability Database".
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0812 ‼
📖 Read
via "National Vulnerability Database".
An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0851 ‼
📖 Read
via "National Vulnerability Database".
There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of how the activation key is supplied to convert2rhel because it involves how convert2rhel provides it to subscription-manager.📖 Read
via "National Vulnerability Database".