📢 Cuba ransomware group claims attack on Montenegro government 📢
📖 Read
via "ITPro".
The double extortion specialists claim to have stolen the data days before Montenegro announced a sustained and co-ordinated series of cyber attacks targeting it from Russia📖 Read
via "ITPro".
IT PRO
Cuba ransomware group claims attack on Montenegro government | IT PRO
The double extortion specialists claim to have stolen the data days before Montenegro announced a sustained and co-ordinated series of cyber attacks targeting it from Russia
📢 MI5 reveals it has been working with an AI non-profit on national security since 2017 📢
📖 Read
via "ITPro".
The security service has been working with The Alan Turing Institute and has decided to unveil the partnership today to allow the pair to work more closely together📖 Read
via "ITPro".
IT PRO
MI5 reveals it has been working with an AI non-profit on national security since 2017 | IT PRO
The security service has been working with The Alan Turing Institute and has decided to unveil the partnership today to allow the pair to work more closely together
‼ CVE-2022-37123 ‼
📖 Read
via "National Vulnerability Database".
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37125 ‼
📖 Read
via "National Vulnerability Database".
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36051 ‼
📖 Read
via "National Vulnerability Database".
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login. **Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically. Due to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organizations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability. There is currently no known workaround, users should update.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37130 ‼
📖 Read
via "National Vulnerability Database".
In D-Link DIR-816 A2_v1.10CNB04.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36619 ‼
📖 Read
via "National Vulnerability Database".
In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37129 ‼
📖 Read
via "National Vulnerability Database".
D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte_4836B0 by snprintf, and finally doSystem(&byte_4836B0); will be executed, resulting in a command injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3072 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.📖 Read
via "National Vulnerability Database".
🗓️ WatchGuard firewall exploit threatens appliance takeover 🗓️
📖 Read
via "The Daily Swig".
One-two bug punch leads to ‘worst possible impact’, said researcher📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
WatchGuard firewall exploit threatens appliance takeover
One-two bug punch leads to ‘worst possible impact’, said researcher
👍1
🕴 (ISC)(2) Launches 'Certified in Cybersecurity' Entry-Level Certification to Address Global Workforce Gap 🕴
📖 Read
via "Dark Reading".
After a rigorous pilot program, the association's newest certification is officially operational. More than 1,500 pilot participants who passed the exam are on the path to full certification.📖 Read
via "Dark Reading".
Dark Reading
(ISC)² Launches 'Certified in Cybersecurity' Entry-Level Certification to Address Global Workforce Gap
After a rigorous pilot program, the association's newest certification is officially operational. More than 1,500 pilot participants who passed the exam are on the path to full certification.
🕴 Real-World Cloud Attacks: The True Tasks of Cloud Ransomware Mitigation 🕴
📖 Read
via "Dark Reading".
Cloud breaches are inevitable — and so is cloud ransomware. (Second of two parts.)📖 Read
via "Dark Reading".
Dark Reading
Real-World Cloud Attacks: The True Tasks of Cloud Ransomware Mitigation
Cloud breaches are inevitable — and so is cloud ransomware. (Second of two parts.)
‼ CVE-2022-38790 ‼
📖 Read
via "National Vulnerability Database".
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36053 ‼
📖 Read
via "National Vulnerability Database".
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer module (os/net/ipv6/uipbuf.c) that processes IPv6 extension headers in incoming data packets. As part of this processing, the function uipbuf_get_next_header casts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expected to be found, and then reads from this structure. Because of a lack of bounds checking, the casting can be done so that the structure extends beyond the packet's end. Hence, with a carefully crafted packet, it is possible to cause the Contiki-NG system to read data outside the packet buffer. A patch that fixes the vulnerability is included in Contiki-NG 4.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36055 ‼
📖 Read
via "National Vulnerability Database".
Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. The _strvals_ package contains a parser that turns strings in to Go structures. The _strvals_ package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing an out of memory panic. Applications that use the _strvals_ package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been resolved in 3.9.4. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36054 ‼
📖 Read
via "National Vulnerability Database".
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (file os/net/ipv6/sicslowpan.c) contains an input function that processes incoming packets and copies them into a packet buffer. Because of a missing length check in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be exploited by anyone who has the possibility to send 6LoWPAN packets to a Contiki-NG system. In particular, the vulnerability is exposed when sending either of two types of 6LoWPAN packets: an unfragmented packet or the first fragment of a fragmented packet. If the packet is sufficiently large, a subsequent memory copy will cause an out-of-bounds write with data supplied by the attacker.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36052 ‼
📖 Read
via "National Vulnerability Database".
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in Contiki-NG may cast a UDP header structure at a certain offset in a packet buffer. The code does not check whether the packet buffer is large enough to fit a full UDP header structure from the offset where the casting is made. Hence, it is possible to cause an out-of-bounds read beyond the packet buffer. The problem affects anyone running devices with Contiki-NG versions previous to 4.8, and which may receive 6LoWPAN packets from external parties. The problem has been patched in Contiki-NG version 4.8.📖 Read
via "National Vulnerability Database".
🕴 Apple Quietly Releases Another Patch for Zero-Day RCE Bug 🕴
📖 Read
via "Dark Reading".
Apple continues a staged update process to address a WebKit vulnerability that allows attackers to craft malicious web content to load malware on affected devices.📖 Read
via "Dark Reading".
Dark Reading
Apple Quietly Releases Another Patch for Zero-Day RCE Bug
Apple continues a staged update process to address a WebKit vulnerability that allows attackers to craft malicious Web content to load malware on affected devices.
‼ CVE-2022-37435 ‼
📖 Read
via "National Vulnerability Database".
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.📖 Read
via "National Vulnerability Database".
🛠 GNU Privacy Guard 2.2.38 🛠
📖 Read
via "Packet Storm Security".
GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions. This is the LTS release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
GNU Privacy Guard 2.2.38 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
⚠ S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]
Latest episode – listen now!
👍1