🗓️ Uber hack linked to hardcoded secrets spotted in powershell script 🗓️
📖 Read
via "The Daily Swig".
Social engineering attack compromises internal networks and Uber’s bug bounty reports📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Uber hack linked to hardcoded secrets spotted in PowerShell script
Social engineering attack compromises internal networks and Uber’s bug bounty reports
⚠ UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you ⚠
📖 Read
via "Naked Security".
Uber is all over the news for a widely-publicised data breach. We help you answer the question, "How do I stop this happening to me?"📖 Read
via "Naked Security".
Naked Security
UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you
Uber is all over the news for a widely-publicised data breach. We help you answer the question, “How do I stop this happening to me?”
🗓️ NETGEAR resolves router vulnerabilities in bundled gaming component 🗓️
📖 Read
via "The Daily Swig".
Silicon Valley vendor tackles command injection and MitM-to-RCE issues📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
NETGEAR resolves router vulnerabilities in bundled gaming component
Silicon Valley vendor tackles command injection and MitM-to-RCE issues
‼ CVE-2022-38828 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37250 ‼
📖 Read
via "National Vulnerability Database".
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38833 ‼
📖 Read
via "National Vulnerability Database".
School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/modstudent/index.php?view=view&id=.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-38846 ‼
📖 Read
via "National Vulnerability Database".
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38843 ‼
📖 Read
via "National Vulnerability Database".
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38823 ‼
📖 Read
via "National Vulnerability Database".
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38808 ‼
📖 Read
via "National Vulnerability Database".
ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38827 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3176 ‼
📖 Read
via "National Vulnerability Database".
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42949 ‼
📖 Read
via "National Vulnerability Database".
The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38844 ‼
📖 Read
via "National Vulnerability Database".
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38845 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38831 ‼
📖 Read
via "National Vulnerability Database".
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/SetNetControlList📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38829 ‼
📖 Read
via "National Vulnerability Database".
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setMacFilterCfg.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38826 ‼
📖 Read
via "National Vulnerability Database".
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38830 ‼
📖 Read
via "National Vulnerability Database".
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setIPv6Status.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38832 ‼
📖 Read
via "National Vulnerability Database".
School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/department/index.php?view=edit&id=.📖 Read
via "National Vulnerability Database".
♟️ Botched Crypto Mugging Lands Three U.K. Men in Jail ♟️
📖 Read
via "Krebs on Security".
Three men in the United Kingdom were arrested this month after police responding to an attempted break-in at a residence stopped their car as they fled the scene. The authorities found weapons and a police uniform in the trunk, and say the trio intended to assault a local man and force him to hand over virtual currencies. 📖 Read
via "Krebs on Security".
Krebs on Security
Botched Crypto Mugging Lands Three U.K. Men in Jail
Three men in the United Kingdom were arrested this month after police responding to an attempted break-in at a residence stopped their car as they fled the scene. The authorities found weapons and a police uniform in the trunk, and…