‼ CVE-2022-34375 ‼
📖 Read
via "National Vulnerability Database".
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to unintentional access to path outside of restricted directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36731 ‼
📖 Read
via "National Vulnerability Database".
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27560 ‼
📖 Read
via "National Vulnerability Database".
HCL VersionVault Express exposes administrator credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36745 ‼
📖 Read
via "National Vulnerability Database".
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27563 ‼
📖 Read
via "National Vulnerability Database".
An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36748 ‼
📖 Read
via "National Vulnerability Database".
PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36747 ‼
📖 Read
via "National Vulnerability Database".
Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36749 ‼
📖 Read
via "National Vulnerability Database".
RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36746 ‼
📖 Read
via "National Vulnerability Database".
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39047 ‼
📖 Read
via "National Vulnerability Database".
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37021 ‼
📖 Read
via "National Vulnerability Database".
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37023 ‼
📖 Read
via "National Vulnerability Database".
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37022 ‼
📖 Read
via "National Vulnerability Database".
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39046 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.📖 Read
via "National Vulnerability Database".
⚠ JavaScript bugs aplenty in Node.js ecosystem – found automatically ⚠
📖 Read
via "Naked Security".
How to get the better of bugs in all the possible packages in your supply chain?📖 Read
via "Naked Security".
Naked Security
JavaScript bugs aplenty in Node.js ecosystem – found automatically
How to get the better of bugs in all the possible packages in your supply chain?
⚠ Chrome patches 24 security holes, enables “Sanitizer” safety system ⚠
📖 Read
via "Naked Security".
24 existing bugs fixed. And, we hope, numerous potential future bugs prevented.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
❌ Student Loan Breach Exposes 2.5M Records ❌
📖 Read
via "Threat Post".
2.5 million people were affected, in a breach that could spell more trouble down the line.📖 Read
via "Threat Post".
Threat Post
Student Loan Breach Exposes 2.5M Records
2.5 million people were affected, in a breach that could spell more trouble down the line.
🕴 SecureAuth Announces General Availability of Arculix, Its Next-Gen Passwordless, Continuous-Authentication Platform 🕴
📖 Read
via "Dark Reading".
Next-gen platform delivers adaptive and robust, continuous authentication with identity orchestration and a frictionless user experience.📖 Read
via "Dark Reading".
Dark Reading
SecureAuth Announces General Availability of Arculix, Its Next-Gen Passwordless, Continuous-Authentication Platform
Next-gen platform delivers adaptive and robust, continuous authentication with identity orchestration and a frictionless user experience.
🕴 The Inevitability of Cloud Breaches: Tales of Real-World Cloud Attacks 🕴
📖 Read
via "Dark Reading".
While cloud breaches are going to happen, that doesn't mean we can't do anything about them. By better understanding cloud attacks, organizations can better prepare for them. (First of two parts.)📖 Read
via "Dark Reading".
Dark Reading
The Inevitability of Cloud Breaches: Tales of Real-World Cloud Attacks
While cloud breaches are going to happen, that doesn't mean we can't do anything about them. By better understanding cloud attacks, organizations can better prepare for them. (First of two parts.)
🗓️ Command injection vulnerability in GitHub Pages nets bug hunter $4k 🗓️
📖 Read
via "The Daily Swig".
Exploit involved duping developers into exposing repositories with social engineering techniques📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Command injection vulnerability in GitHub Pages nets bug hunter $4k
Exploit involved duping developers into exposing repositories with social engineering techniques
🗓️ Three-day hackathon uncovers hundreds of bugs in Yahoo search engine tool Vespa 🗓️
📖 Read
via "The Daily Swig".
Live event brings together bug bounty hunters from across the globe📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Three-day hackathon uncovers hundreds of bugs in Yahoo search engine tool Vespa
Live event brings together bug bounty hunters from across the globe