‼ CVE-2022-40297 ‼
📖 Read
via "National Vulnerability Database".
UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password.📖 Read
via "National Vulnerability Database".
♟️ Transacting in Person with Strangers from the Internet ♟️
📖 Read
via "Krebs on Security".
Communities like Craigslist, OfferUp, Facebook Marketplace and others are great for finding low- or no-cost stuff that one can pick up directly from a nearby seller, and for getting rid of useful things that don't deserve to end up in a landfill. But when dealing with strangers from the Internet, there is always a risk that the person you've agreed to meet has other intentions.📖 Read
via "Krebs on Security".
Krebs on Security
Transacting in Person with Strangers from the Internet
Communities like Craigslist, OfferUp, Facebook Marketplace and others are great for finding low- or no-cost stuff that one can pick up directly from a nearby seller, and for getting rid of useful things that don't deserve to end up in…
🗓️ ManageEngine vulnerability posed code injection risk for password management software 🗓️
📖 Read
via "The Daily Swig".
Authentication-free flaw opened the door to a raft of exploits📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
ManageEngine vulnerability posed code injection risk for password management software
Authentication-free flaw opened the door to a raft of exploits
🗓️ Six-year-old blind SSRF vulnerability in WordPress Core feature could enable DDoS attacks 🗓️
📖 Read
via "The Daily Swig".
Issue present in pingback requests feature📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Six-year-old blind SSRF vulnerability in WordPress Core feature could enable DDoS attacks
Issue present in pingback requests feature
🔏 Friday Five 9/9 🔏
📖 Read
via "".
This week saw two social media giants come under fire once again, malware that cons cybercriminals, and more cyberattacks in Ukraine. Read about these stories and more in this week's Friday Five!
📖 Read
via "".
‼ CVE-2022-38144 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36861 ‼
📖 Read
via "National Vulnerability Database".
Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protected functions with SystemUI privilege.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26390 ‼
📖 Read
via "National Vulnerability Database".
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36793 ‼
📖 Read
via "National Vulnerability Database".
Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36869 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36423 ‼
📖 Read
via "National Vulnerability Database".
OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36864 ‼
📖 Read
via "National Vulnerability Database".
Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged behavior.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36852 ‼
📖 Read
via "National Vulnerability Database".
Improper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local attacker to access internal application data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38286 ‼
📖 Read
via "National Vulnerability Database".
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36863 ‼
📖 Read
via "National Vulnerability Database".
A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36847 ‼
📖 Read
via "National Vulnerability Database".
Use after free vulnerability in mtp_send_signal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38457 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40191 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38058 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36842 ‼
📖 Read
via "National Vulnerability Database".
A heap-based overflow vulnerability in prepareRecogLibrary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36855 ‼
📖 Read
via "National Vulnerability Database".
A use after free vulnerability in iva_ctl driver prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.📖 Read
via "National Vulnerability Database".