‼ CVE-2022-39799 ‼
📖 Read
via "National Vulnerability Database".
An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35295 ‼
📖 Read
via "National Vulnerability Database".
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) - versions 420, 430, exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3179 ‼
📖 Read
via "National Vulnerability Database".
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39801 ‼
📖 Read
via "National Vulnerability Database".
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and completely compromise the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39014 ‼
📖 Read
via "National Vulnerability Database".
Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35294 ‼
📖 Read
via "National Vulnerability Database".
An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3029 ‼
📖 Read
via "National Vulnerability Database".
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may stop your network from validating route origins based on RPKI data. This vulnerability does not allow an attacker to manipulate RPKI data.📖 Read
via "National Vulnerability Database".
🕴 Cyberattackers Abuse Facebook Ad Manager in Savvy Credential-Harvesting Campaign 🕴
📖 Read
via "Dark Reading".
Facebook lead-generation forms are being repurposed to collect passwords and credit card information from unsuspecting Facebook advertisers.📖 Read
via "Dark Reading".
Dark Reading
Cyberattackers Abuse Facebook Ad Manager in Savvy Credential-Harvesting Campaign
Facebook lead-generation forms are being repurposed to collect passwords and credit card information from unsuspecting Facebook advertisers.
🕴 U-Haul Customer Contract Search Tool Compromised 🕴
📖 Read
via "Dark Reading".
Password compromise led to unauthorized access to a customer contract search tool over a five-month window, according to the company.📖 Read
via "Dark Reading".
Dark Reading
U-Haul Customer Contract Search Tool Compromised
Password compromise led to unauthorized access to a customer contract search tool over a five-month window, according to the company.
🕴 ShadowPad Threat Actors Return With Fresh Government Strikes, Updated Tools 🕴
📖 Read
via "Dark Reading".
Cyber spies are using legitimate apps for DLL sideloading, deploying an updated range of malware, including the new "Logdatter" info-stealer.📖 Read
via "Dark Reading".
Dark Reading
ShadowPad Threat Actors Return With Fresh Government Strikes, Updated Tools
Cyber spies are using legitimate apps for DLL sideloading, deploying an updated range of malware, including the new "Logdatter" info-stealer.
‼ CVE-2022-26929 ‼
📖 Read
via "National Vulnerability Database".
.NET Framework Remote Code Execution Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35830 ‼
📖 Read
via "National Vulnerability Database".
Remote Procedure Call Runtime Remote Code Execution Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34722 ‼
📖 Read
via "National Vulnerability Database".
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34721.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35835 ‼
📖 Read
via "National Vulnerability Database".
Microsoft OLE DB Provider for SQL Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34731, CVE-2022-34733, CVE-2022-35834, CVE-2022-35836, CVE-2022-35840.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35832 ‼
📖 Read
via "National Vulnerability Database".
Windows Event Tracing Denial of Service Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34732 ‼
📖 Read
via "National Vulnerability Database".
Microsoft ODBC Driver Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34726, CVE-2022-34727, CVE-2022-34730, CVE-2022-34734.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35803 ‼
📖 Read
via "National Vulnerability Database".
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-37969.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35834 ‼
📖 Read
via "National Vulnerability Database".
Microsoft OLE DB Provider for SQL Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34731, CVE-2022-34733, CVE-2022-35835, CVE-2022-35836, CVE-2022-35840.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30196 ‼
📖 Read
via "National Vulnerability Database".
Windows Secure Channel Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-35833.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33679 ‼
📖 Read
via "National Vulnerability Database".
Windows Kerberos Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-33647.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34730 ‼
📖 Read
via "National Vulnerability Database".
Microsoft ODBC Driver Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34726, CVE-2022-34727, CVE-2022-34732, CVE-2022-34734.📖 Read
via "National Vulnerability Database".