‼ CVE-2022-36961 ‼
📖 Read
via "National Vulnerability Database".
A verb used in Orion was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40313 ‼
📖 Read
via "National Vulnerability Database".
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32540 ‼
📖 Read
via "National Vulnerability Database".
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36839 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40277 ‼
📖 Read
via "National Vulnerability Database".
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36854 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21826 ‼
📖 Read
via "National Vulnerability Database".
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1959 ‼
📖 Read
via "National Vulnerability Database".
AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40315 ‼
📖 Read
via "National Vulnerability Database".
A limited SQL injection risk was identified in the "browse list of users" site administration page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36855 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40314 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40316 ‼
📖 Read
via "National Vulnerability Database".
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36965 ‼
📖 Read
via "National Vulnerability Database".
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).📖 Read
via "National Vulnerability Database".
🕴 Cybercriminals See Allure in BEC Attacks Over Ransomware 🕴
📖 Read
via "Dark Reading".
While ransomware seems stalled, business email compromise (BEC) attacks continue to make profits from the ProxyShell and Log4j vulnerabilities, nearly doubling in the latest quarter.📖 Read
via "Dark Reading".
Dark Reading
Cybercriminals See Allure in BEC Attacks Over Ransomware
While ransomware seems stalled, business email compromise (BEC) attacks continue to make profits from the ProxyShell and Log4j vulnerabilities, nearly doubling in the latest quarter.
🕴 Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here 🕴
📖 Read
via "Dark Reading".
It's time to dispel notions of deepfakes as an emergent threat. All the pieces for widespread attacks are in place and readily available to cybercriminals, even unsophisticated ones.📖 Read
via "Dark Reading".
Dark Reading
Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here
It's time to dispel notions of deepfakes as an emergent threat. All the pieces for widespread attacks are in place and readily available to cybercriminals, even unsophisticated ones.
‼ CVE-2022-20662 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41975 ‼
📖 Read
via "National Vulnerability Database".
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20844 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35155 ‼
📖 Read
via "National Vulnerability Database".
Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20919 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient input validation during processing of CIP packets. An attacker could exploit this vulnerability by sending a malformed CIP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33354 ‼
📖 Read
via "National Vulnerability Database".
Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parameter.📖 Read
via "National Vulnerability Database".