♟️ Microsoft: Two New 0-Day Flaws in Exchange Server ♟️
📖 Read
via "Krebs on Security".
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.📖 Read
via "Krebs on Security".
Krebs on Security
Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to…
🕴 Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack 🕴
📖 Read
via "Dark Reading".
Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.📖 Read
via "Dark Reading".
Darkreading
Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack
Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.
👍1
‼ CVE-2022-40274 ‼
📖 Read
via "National Vulnerability Database".
Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28851 ‼
📖 Read
via "National Vulnerability Database".
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36830 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36961 ‼
📖 Read
via "National Vulnerability Database".
A verb used in Orion was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40313 ‼
📖 Read
via "National Vulnerability Database".
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32540 ‼
📖 Read
via "National Vulnerability Database".
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36839 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40277 ‼
📖 Read
via "National Vulnerability Database".
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36854 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21826 ‼
📖 Read
via "National Vulnerability Database".
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1959 ‼
📖 Read
via "National Vulnerability Database".
AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40315 ‼
📖 Read
via "National Vulnerability Database".
A limited SQL injection risk was identified in the "browse list of users" site administration page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36855 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40314 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40316 ‼
📖 Read
via "National Vulnerability Database".
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36965 ‼
📖 Read
via "National Vulnerability Database".
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).📖 Read
via "National Vulnerability Database".
🕴 Cybercriminals See Allure in BEC Attacks Over Ransomware 🕴
📖 Read
via "Dark Reading".
While ransomware seems stalled, business email compromise (BEC) attacks continue to make profits from the ProxyShell and Log4j vulnerabilities, nearly doubling in the latest quarter.📖 Read
via "Dark Reading".
Dark Reading
Cybercriminals See Allure in BEC Attacks Over Ransomware
While ransomware seems stalled, business email compromise (BEC) attacks continue to make profits from the ProxyShell and Log4j vulnerabilities, nearly doubling in the latest quarter.
🕴 Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here 🕴
📖 Read
via "Dark Reading".
It's time to dispel notions of deepfakes as an emergent threat. All the pieces for widespread attacks are in place and readily available to cybercriminals, even unsophisticated ones.📖 Read
via "Dark Reading".
Dark Reading
Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here
It's time to dispel notions of deepfakes as an emergent threat. All the pieces for widespread attacks are in place and readily available to cybercriminals, even unsophisticated ones.
‼ CVE-2022-20662 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user.📖 Read
via "National Vulnerability Database".