🛠 Suricata IDPE 6.0.7 🛠
📖 Read
via "Packet Storm Security".
Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Suricata IDPE 6.0.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2022-39256 ‼
📖 Read
via "National Vulnerability Database".
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.📖 Read
via "National Vulnerability Database".
⚠ WhatsApp “zero-day exploit” news scare – what you need to know ⚠
📖 Read
via "Naked Security".
Is WhatsApp currently under active attack by cyercriminals? Is this a clear and current danger? How worried should WhatsApp users be?📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
👍3
‼ CVE-2021-27854 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27862 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27861 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27853 ‼
📖 Read
via "National Vulnerability Database".
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37346 ‼
📖 Read
via "National Vulnerability Database".
EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39835 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38975 ‼
📖 Read
via "National Vulnerability Database".
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38335 ‼
📖 Read
via "National Vulnerability Database".
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37209 ‼
📖 Read
via "National Vulnerability Database".
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3324 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40199 ‼
📖 Read
via "National Vulnerability Database".
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41604 ‼
📖 Read
via "National Vulnerability Database".
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41571 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40878 ‼
📖 Read
via "National Vulnerability Database".
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40352 ‼
📖 Read
via "National Vulnerability Database".
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41570 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40353 ‼
📖 Read
via "National Vulnerability Database".
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40817 ‼
📖 Read
via "National Vulnerability Database".
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.📖 Read
via "National Vulnerability Database".