🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-37794 ‼

In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.

📖 Read

via "National Vulnerability Database".
459 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-36254 ‼

Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".

📖 Read

via "National Vulnerability Database".
421 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-37796 ‼

In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable to Cross Site Scripting(XSS).

📖 Read

via "National Vulnerability Database".
388 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-36257 ‼

A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "users", "pass", etc.

📖 Read

via "National Vulnerability Database".
329 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-36259 ‼

A SQL injection vulnerability in ConnectionFactory.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "username", "password", etc.

📖 Read

via "National Vulnerability Database".
306 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-36258 ‼

A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "searchTxt".

📖 Read

via "National Vulnerability Database".
308 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-36255 ‼

A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "searchTxt".

📖 Read

via "National Vulnerability Database".
314 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-34109 ‼

An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless of file type or size.

📖 Read

via "National Vulnerability Database".
332 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-38972 ‼

Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.

📖 Read

via "National Vulnerability Database".
365 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-34110 ‼

An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file type or size.

📖 Read

via "National Vulnerability Database".
458 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-34108 ‼

An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a crafted image or video file.

📖 Read

via "National Vulnerability Database".
496 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-36256 ‼

A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "productcode".

📖 Read

via "National Vulnerability Database".
564 views
🛡 Cybersecurity & Privacy 🛡 - News
🗓️ WordPress project WPHash harvests 75 million hashes for detecting vulnerable plugins 🗓️

Project mission is to crowdsource the indexing and curating of plugin bug data

📖 Read

via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
WordPress project WPHash harvests 75 million hashes for detecting vulnerable plugins
Project mission is to crowdsource the indexing and curating of plugin bug data
564 views
🛡 Cybersecurity & Privacy 🛡 - News
🗓️ Vulnerability in Xalan-J could allow arbitrary code execution 🗓️

Open source project is used by various SAML implementations

📖 Read

via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Vulnerability in Xalan-J could allow arbitrary code execution
Open source project is used by various SAML implementations
541 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-37767 ‼

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok

📖 Read

via "National Vulnerability Database".
470 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-37734 ‼

graphql-java before19.0 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources.

📖 Read

via "National Vulnerability Database".
426 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-37797 ‼

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

📖 Read

via "National Vulnerability Database".
443 views
🛡 Cybersecurity & Privacy 🛡 - News
⚠ How to deal with dates and times without any timezone tantrums… ⚠

Heartfelt encouragement to embrace RFC 3339 - find out why!

📖 Read

via "Naked Security".
Naked Security
How to deal with dates and times without any timezone tantrums…
Heartfelt encouragement to embrace RFC 3339 – find out why!
416 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-3178 ‼

Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.

📖 Read

via "National Vulnerability Database".
384 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-31220 ‼

Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order to change the state of the system or cause unexpected failures.

📖 Read

via "National Vulnerability Database".
345 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-37300 ‼

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

📖 Read

via "National Vulnerability Database".
330 views