‼ CVE-2022-40152 ‼
📖 Read
via "National Vulnerability Database".
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40153 ‼
📖 Read
via "National Vulnerability Database".
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40151 ‼
📖 Read
via "National Vulnerability Database".
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40149 ‼
📖 Read
via "National Vulnerability Database".
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3223 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40156 ‼
📖 Read
via "National Vulnerability Database".
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40150 ‼
📖 Read
via "National Vulnerability Database".
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40155 ‼
📖 Read
via "National Vulnerability Database".
Those using Xstream to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.📖 Read
via "National Vulnerability Database".
🛠 Packet Fence 12.0.0 🛠
📖 Read
via "Packet Storm Security".
PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Packet Fence 12.0.0 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🔏 Friday Five 9/16 🔏
📖 Read
via "".
Twitter’s security scandal going from bad to worse and malware spreading through YouTube made headlines this week. Read about these stories and more in this week’s Friday Five!
📖 Read
via "".
🗓️ Uber hack linked to hardcoded secrets spotted in powershell script 🗓️
📖 Read
via "The Daily Swig".
Social engineering attack compromises internal networks and Uber’s bug bounty reports📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Uber hack linked to hardcoded secrets spotted in PowerShell script
Social engineering attack compromises internal networks and Uber’s bug bounty reports
⚠ UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you ⚠
📖 Read
via "Naked Security".
Uber is all over the news for a widely-publicised data breach. We help you answer the question, "How do I stop this happening to me?"📖 Read
via "Naked Security".
Naked Security
UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you
Uber is all over the news for a widely-publicised data breach. We help you answer the question, “How do I stop this happening to me?”
🗓️ NETGEAR resolves router vulnerabilities in bundled gaming component 🗓️
📖 Read
via "The Daily Swig".
Silicon Valley vendor tackles command injection and MitM-to-RCE issues📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
NETGEAR resolves router vulnerabilities in bundled gaming component
Silicon Valley vendor tackles command injection and MitM-to-RCE issues
‼ CVE-2022-38828 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37250 ‼
📖 Read
via "National Vulnerability Database".
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38833 ‼
📖 Read
via "National Vulnerability Database".
School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/modstudent/index.php?view=view&id=.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-38846 ‼
📖 Read
via "National Vulnerability Database".
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38843 ‼
📖 Read
via "National Vulnerability Database".
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38823 ‼
📖 Read
via "National Vulnerability Database".
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38808 ‼
📖 Read
via "National Vulnerability Database".
ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38827 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi📖 Read
via "National Vulnerability Database".