🕴 With the Software Supply Chain, You Can't Secure What You Don't Measure 🕴
📖 Read
via "Dark Reading".
Reports to the National Vulnerability Database jumped in 2022, but we should pay just as much attention to the flaws that are not being reported to NVD, including those affecting the software supply chain.📖 Read
via "Dark Reading".
Darkreading
With the Software Supply Chain, You Can't Secure What You Don't Measure
Reports to the National Vulnerability Database jumped in 2022, but we should pay just as much attention to the flaws that are not being reported to NVD, including those affecting the software supply chain.
🕴 SolarMarker Attack Leverages Weak WordPress Sites, Fake Chrome Browser Updates 🕴
📖 Read
via "Dark Reading".
The SolarMarker group is exploiting a vulnerable WordPress-run website to encourage victims to download fake Chrome browser updates, part of a new tactic in its watering-hole attacks.📖 Read
via "Dark Reading".
Dark Reading
SolarMarker Attack Leverages Weak WordPress Sites, Fake Chrome Browser Updates
The SolarMarker group is exploiting a vulnerable WordPress-run website to encourage victims to download fake Chrome browser updates, part of a new tactic in its watering-hole attacks.
🗓️ Bug Bounty Radar // The latest bug bounty programs for October 2022 🗓️
📖 Read
via "The Daily Swig".
New web targets for the discerning hacker📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Bug Bounty Radar // The latest bug bounty programs for October 2022
New web targets for the discerning hacker
‼ CVE-2022-41437 ‼
📖 Read
via "National Vulnerability Database".
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-23726 ‼
📖 Read
via "National Vulnerability Database".
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3371 ‼
📖 Read
via "National Vulnerability Database".
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41440 ‼
📖 Read
via "National Vulnerability Database".
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41439 ‼
📖 Read
via "National Vulnerability Database".
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37461 ‼
📖 Read
via "National Vulnerability Database".
Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.📖 Read
via "National Vulnerability Database".
🕴 Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet 🕴
📖 Read
via "Dark Reading".
The "ProxyNotShell" security vulnerabilities can be chained for remote code execution and total takeover of corporate email platforms.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet
The "ProxyNotShell" security vulnerabilities can be chained for remote code execution and total takeover of corporate email platforms.
♟️ Microsoft: Two New 0-Day Flaws in Exchange Server ♟️
📖 Read
via "Krebs on Security".
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.📖 Read
via "Krebs on Security".
Krebs on Security
Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to…
🕴 Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack 🕴
📖 Read
via "Dark Reading".
Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.📖 Read
via "Dark Reading".
Darkreading
Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack
Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.
👍1
‼ CVE-2022-40274 ‼
📖 Read
via "National Vulnerability Database".
Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28851 ‼
📖 Read
via "National Vulnerability Database".
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36830 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36961 ‼
📖 Read
via "National Vulnerability Database".
A verb used in Orion was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40313 ‼
📖 Read
via "National Vulnerability Database".
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32540 ‼
📖 Read
via "National Vulnerability Database".
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36839 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40277 ‼
📖 Read
via "National Vulnerability Database".
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36854 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.📖 Read
via "National Vulnerability Database".