‼ CVE-2022-39254 ‼
📖 Read
via "National Vulnerability Database".
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40407 ‼
📖 Read
via "National Vulnerability Database".
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38732 ‼
📖 Read
via "National Vulnerability Database".
SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39252 ‼
📖 Read
via "National Vulnerability Database".
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-40408 ‼
📖 Read
via "National Vulnerability Database".
FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33880 ‼
📖 Read
via "National Vulnerability Database".
hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35137 ‼
📖 Read
via "National Vulnerability Database".
DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39266 ‼
📖 Read
via "National Vulnerability Database".
isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. As of time of publication, there are no known fixed versions or workarounds.📖 Read
via "National Vulnerability Database".
♟️ Fake CISO Profiles on LinkedIn Target Fortune 500s ♟️
📖 Read
via "Krebs on Security".
Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources.📖 Read
via "Krebs on Security".
Krebs on Security
Fake CISO Profiles on LinkedIn Target Fortune 500s
Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may…
‼ CVE-2022-36066 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3364 ‼
📖 Read
via "National Vulnerability Database".
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40472 ‼
📖 Read
via "National Vulnerability Database".
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39232 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41828 ‼
📖 Read
via "National Vulnerability Database".
In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36068 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39226 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.📖 Read
via "National Vulnerability Database".
🕴 Ransomware Attacks Continue Increasing: 20% of All Reported Attacks Occurred in the Last 12 Months - New Survey 🕴
📖 Read
via "Dark Reading".
Survey of over 2,000 IT pros revealed that a quarter either don't know or don't think Microsoft 365 data can be affected by ransomware.📖 Read
via "Dark Reading".
Darkreading
Ransomware Attacks Continue Increasing: 20% of All Reported Attacks Occurred in the Last 12 Months - New Survey
Survey of over 2,000 IT pros revealed that a quarter either don't know or don't think Microsoft 365 data can be affected by ransomware.
🕴 Intel Hardens Confidential Computing With Project Amber Updates 🕴
📖 Read
via "Dark Reading".
The chip giant has developed new features and services to make it more difficult for malicious hackers and insiders to access sensitive data from applications in the cloud.📖 Read
via "Dark Reading".
Dark Reading
Intel Hardens Confidential Computing With Project Amber Updates
The chip giant has developed new features and services to make it tougher for malicious hackers and insiders to access sensitive data from applications in the cloud.
🕴 KnowBe4 Simplifies Compliance Requirements for Healthcare Privacy 🕴
📖 Read
via "Dark Reading".
KnowBe4's Compliance Audit Readiness Assessment (CARA) now addresses select requirements from HIPAA Security Rule.📖 Read
via "Dark Reading".
Darkreading
KnowBe4 Simplifies Compliance Requirements for Healthcare Privacy
KnowBe4's Compliance Audit Readiness Assessment (CARA) now addresses select requirements from HIPAA Security Rule.
🕴 Pathlock Expands SAP Capabilities with Acquisition of Grey Monarch 🕴
📖 Read
via "Dark Reading".
Combination of two companies to help SAP customers streamline audit, compliance and control processes.📖 Read
via "Dark Reading".
Darkreading
Pathlock Expands SAP Capabilities with Acquisition of Grey Monarch
Combination of two companies to help SAP customers streamline audit, compliance and control processes.
🕴 Organizations Finding the Need for New Approaches on the Cybersecurity Front, CompTIA research reveals 🕴
📖 Read
via "Dark Reading".
Settling for 'satisfactory' level of readiness may underestimate growing levels of risk.📖 Read
via "Dark Reading".
Darkreading
Organizations Finding the Need for New Approaches on the Cybersecurity Front, CompTIA research reveals
Settling for 'satisfactory' level of readiness may underestimate growing levels of risk.