βΌ CVE-2022-39878 βΌ
π Read
via "National Vulnerability Database".
Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast.π Read
via "National Vulnerability Database".
βΌ CVE-2022-39868 βΌ
π Read
via "National Vulnerability Database".
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.π Read
via "National Vulnerability Database".
βΌ CVE-2022-39872 βΌ
π Read
via "National Vulnerability Database".
Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.π Read
via "National Vulnerability Database".
βΌ CVE-2022-39874 βΌ
π Read
via "National Vulnerability Database".
Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.π Read
via "National Vulnerability Database".
π΄ LofyGang Uses 100s of Malicious NPM Packages to Poison Open Source Software π΄
π Read
via "Dark Reading".
The group has been operating for over a year, promoting their tools in hacking forums, stealing credit card information, and using typosquatting techniques to target open source software flaws.π Read
via "Dark Reading".
Dark Reading
LofyGang Uses 100s of Malicious NPM Packages to Poison Open Source Software
The group has been operating for over a year, promoting their tools in hacking forums, stealing credit card information, and using typosquatting techniques to target open source software flaws.
β WhatsApp goes after Chinese password scammers via US court β
π Read
via "Naked Security".
If you can't beat 'em, sue 'em!π Read
via "Naked Security".
Naked Security
WhatsApp goes after Chinese password scammers via US court
If you canβt beat βem, sue βem!
π΄ Patch Now: Fortinet FortiGate & FortiProxy Contain Critical Vuln π΄
π Read
via "Dark Reading".
Fortinet issued a customer advisory urging customers to apply its update immediately.π Read
via "Dark Reading".
Dark Reading
Patch Now: Fortinet FortiGate & FortiProxy Contain Critical Vuln
The bug is under active exploitation; Fortinet issued a customer advisory urging customers to apply its update immediately.
π΄ State Bar of Georgia Notifies Members and Employees of Cybersecurity Incident π΄
π Read
via "Dark Reading".
Current and former employees and members are being offered complimentary credit monitoring and identity protection services as some personal information may have been accessed.π Read
via "Dark Reading".
Dark Reading
State Bar of Georgia Notifies Members and Employees of Cybersecurity Incident
<p>Current and former employees and members are being offered complimentary credit monitoring and
identity protection services as some personal information may have been accessed.</p>
identity protection services as some personal information may have been accessed.</p>
βΌ CVE-2022-22493 βΌ
π Read
via "National Vulnerability Database".
IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449.π Read
via "National Vulnerability Database".
βΌ CVE-2022-30613 βΌ
π Read
via "National Vulnerability Database".
IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366.π Read
via "National Vulnerability Database".
βΌ CVE-2022-36772 βΌ
π Read
via "National Vulnerability Database".
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.π Read
via "National Vulnerability Database".
βΌ CVE-2022-22480 βΌ
π Read
via "National Vulnerability Database".
IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Force ID: 225889.π Read
via "National Vulnerability Database".
βΌ CVE-2022-41291 βΌ
π Read
via "National Vulnerability Database".
IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34308 βΌ
π Read
via "National Vulnerability Database".
IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.π Read
via "National Vulnerability Database".
βοΈ Report: Big U.S. Banks Are Stiffing Account Takeover Victims βοΈ
π Read
via "Krebs on Security".
When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation's largest banks, reimbursing account takeover victims has become more the exception than the rule.π Read
via "Krebs on Security".
Krebs on Security
Report: Big U.S. Banks Are Stiffing Account Takeover Victims
When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data releasedβ¦
βΌ CVE-2022-41513 βΌ
π Read
via "National Vulnerability Database".
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php.π Read
via "National Vulnerability Database".
βΌ CVE-2022-41378 βΌ
π Read
via "National Vulnerability Database".
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory.π Read
via "National Vulnerability Database".
βΌ CVE-2022-37896 βΌ
π Read
via "National Vulnerability Database".
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimΓ’β¬β’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40162 βΌ
π Read
via "National Vulnerability Database".
A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.π Read
via "National Vulnerability Database".
βΌ CVE-2022-37887 βΌ
π Read
via "National Vulnerability Database".
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.π Read
via "National Vulnerability Database".
βΌ CVE-2022-37889 βΌ
π Read
via "National Vulnerability Database".
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.π Read
via "National Vulnerability Database".