‼ CVE-2022-2924 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39955 ‼
📖 Read
via "National Vulnerability Database".
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" names and therefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3000 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39957 ‼
📖 Read
via "National Vulnerability Database".
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.📖 Read
via "National Vulnerability Database".
⚠ LastPass source code breach – incident response report released ⚠
📖 Read
via "Naked Security".
Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-3005 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3079 ‼
📖 Read
via "National Vulnerability Database".
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3242 ‼
📖 Read
via "National Vulnerability Database".
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3004 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2177 ‼
📖 Read
via "National Vulnerability Database".
Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.📖 Read
via "National Vulnerability Database".
🛠 Zeek 5.0.2 🛠
📖 Read
via "Packet Storm Security".
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyber-infrastructure. Zeek's user community includes major universities, research labs, supercomputing centers, and open-science communities. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Zeek 5.0.2 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🗓️ Parse Server fixes brute-forcing bug that put sensitive user data at risk 🗓️
📖 Read
via "The Daily Swig".
Open source project provides push notification functionality for iOS, macOS, Android, and tvOS📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Parse Server fixes brute-forcing bug that put sensitive user data at risk
Open source project provides push notification functionality for iOS, macOS, Android, and tvOS
‼ CVE-2021-33081 ‼
📖 Read
via "National Vulnerability Database".
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40955 ‼
📖 Read
via "National Vulnerability Database".
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33079 ‼
📖 Read
via "National Vulnerability Database".
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32167 ‼
📖 Read
via "National Vulnerability Database".
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33076 ‼
📖 Read
via "National Vulnerability Database".
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3245 ‼
📖 Read
via "National Vulnerability Database".
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30579 ‼
📖 Read
via "National Vulnerability Database".
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38340 ‼
📖 Read
via "National Vulnerability Database".
Safe Software FME Server v2022.0.1.1 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26873 ‼
📖 Read
via "National Vulnerability Database".
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.📖 Read
via "National Vulnerability Database".