🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-42904 ‼

Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.

📖 Read

via "National Vulnerability Database".
281 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-38871 ‼

In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.

📖 Read

via "National Vulnerability Database".
267 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-44584 ‼

Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

📖 Read

via "National Vulnerability Database".
269 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4055 ‼

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

📖 Read

via "National Vulnerability Database".
277 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-40698 ‼

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

📖 Read

via "National Vulnerability Database".
275 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-34665 ‼

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.

📖 Read

via "National Vulnerability Database".
291 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-37936 ‼

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

📖 Read

via "National Vulnerability Database".
323 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-41634 ‼

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

📖 Read

via "National Vulnerability Database".
362 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-31610 ‼

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds write, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

📖 Read

via "National Vulnerability Database".
475 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-31694 ‼

InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL.

📖 Read

via "National Vulnerability Database".
598 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-43492 ‼

Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.

📖 Read

via "National Vulnerability Database".
👍1
648 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4066 ‼

A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. The manipulation leads to allocation of resources. The name of the patch is de8ea938342b36c28024fd8393ebc27b8442a161. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-214028.

📖 Read

via "National Vulnerability Database".
569 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4065 ‼

A vulnerability was found in cbeust testng. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-214027.

📖 Read

via "National Vulnerability Database".
628 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4064 ‼

A vulnerability was found in Dalli. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to apply a patch to fix this issue. VDB-214026 is the identifier assigned to this vulnerability.

📖 Read

via "National Vulnerability Database".
👍1
566 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-3525 ‼

Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.

📖 Read

via "National Vulnerability Database".
489 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4067 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

📖 Read

via "National Vulnerability Database".
491 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-3562 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

📖 Read

via "National Vulnerability Database".
472 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4069 ‼

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.

📖 Read

via "National Vulnerability Database".
456 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4070 ‼

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.

📖 Read

via "National Vulnerability Database".
458 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-4068 ‼

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.

📖 Read

via "National Vulnerability Database".
519 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-3516 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

📖 Read

via "National Vulnerability Database".
👍1
524 views