‼ CVE-2022-39958 ‼
📖 Read
via "National Vulnerability Database".
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39956 ‼
📖 Read
via "National Vulnerability Database".
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34917 ‼
📖 Read
via "National Vulnerability Database".
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2924 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39955 ‼
📖 Read
via "National Vulnerability Database".
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" names and therefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3000 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39957 ‼
📖 Read
via "National Vulnerability Database".
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.📖 Read
via "National Vulnerability Database".
⚠ LastPass source code breach – incident response report released ⚠
📖 Read
via "Naked Security".
Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-3005 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3079 ‼
📖 Read
via "National Vulnerability Database".
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3242 ‼
📖 Read
via "National Vulnerability Database".
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3004 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2177 ‼
📖 Read
via "National Vulnerability Database".
Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.📖 Read
via "National Vulnerability Database".
🛠 Zeek 5.0.2 🛠
📖 Read
via "Packet Storm Security".
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyber-infrastructure. Zeek's user community includes major universities, research labs, supercomputing centers, and open-science communities. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Zeek 5.0.2 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🗓️ Parse Server fixes brute-forcing bug that put sensitive user data at risk 🗓️
📖 Read
via "The Daily Swig".
Open source project provides push notification functionality for iOS, macOS, Android, and tvOS📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Parse Server fixes brute-forcing bug that put sensitive user data at risk
Open source project provides push notification functionality for iOS, macOS, Android, and tvOS
‼ CVE-2021-33081 ‼
📖 Read
via "National Vulnerability Database".
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40955 ‼
📖 Read
via "National Vulnerability Database".
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33079 ‼
📖 Read
via "National Vulnerability Database".
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32167 ‼
📖 Read
via "National Vulnerability Database".
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33076 ‼
📖 Read
via "National Vulnerability Database".
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3245 ‼
📖 Read
via "National Vulnerability Database".
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.📖 Read
via "National Vulnerability Database".