‼ CVE-2022-3201 ‼
📖 Read
via "National Vulnerability Database".
Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3200 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3272 ‼
📖 Read
via "National Vulnerability Database".
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30003 ‼
📖 Read
via "National Vulnerability Database".
Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3290 ‼
📖 Read
via "National Vulnerability Database".
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3298 ‼
📖 Read
via "National Vulnerability Database".
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39258 ‼
📖 Read
via "National Vulnerability Database".
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.📖 Read
via "National Vulnerability Database".
👍1
🛠 Suricata IDPE 6.0.7 🛠
📖 Read
via "Packet Storm Security".
Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Suricata IDPE 6.0.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2022-39256 ‼
📖 Read
via "National Vulnerability Database".
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.📖 Read
via "National Vulnerability Database".
⚠ WhatsApp “zero-day exploit” news scare – what you need to know ⚠
📖 Read
via "Naked Security".
Is WhatsApp currently under active attack by cyercriminals? Is this a clear and current danger? How worried should WhatsApp users be?📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
👍3
‼ CVE-2021-27854 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27862 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27861 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27853 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37346 ‼
📖 Read
via "National Vulnerability Database".
EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39835 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38975 ‼
📖 Read
via "National Vulnerability Database".
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38335 ‼
📖 Read
via "National Vulnerability Database".
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37209 ‼
📖 Read
via "National Vulnerability Database".
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3324 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40199 ‼
📖 Read
via "National Vulnerability Database".
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.📖 Read
via "National Vulnerability Database".