‼ CVE-2022-45045 ‼
📖 Read
via "National Vulnerability Database".
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40849 ‼
📖 Read
via "National Vulnerability Database".
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40489 ‼
📖 Read
via "National Vulnerability Database".
ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-44262 ‼
📖 Read
via "National Vulnerability Database".
ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1471 ‼
📖 Read
via "National Vulnerability Database".
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3270 ‼
📖 Read
via "National Vulnerability Database".
In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.📖 Read
via "National Vulnerability Database".
🕴 Guidehouse Insights Anticipates Market for Automotive Cybersecurity Solutions Will Grow to More Than $445 Billion by 2031 🕴
📖 Read
via "Dark Reading".
Market drivers include new regulations, increasing automobile complexity, and new vehicle types.📖 Read
via "Dark Reading".
Dark Reading
Guidehouse Insights Anticipates Market for Automotive Cybersecurity Solutions Will Grow to More Than $445 Billion by 2031
Market drivers include new regulations, increasing automobile complexity, and new vehicle types.
🕴 CyberRatings.org Announces Results from First-of-its-Kind Comparative Test on Cloud Network Firewall 🕴
📖 Read
via "Dark Reading".
Ratings ranged from AAA to CC, with security effectiveness scores from 27% to 100%.📖 Read
via "Dark Reading".
Dark Reading
CyberRatings.org Announces Results from First-of-its-Kind Comparative Test on Cloud Network Firewall
Ratings ranged from AAA to CC, with security effectiveness scores from 27% to 100%.
👍1
🕴 Data Security Concerns Are Driving Changes in US Consumer Behavior and Demands 🕴
📖 Read
via "Dark Reading".
As consumers catch on to the dangers, protection could become a major topic for legislative bodies.📖 Read
via "Dark Reading".
Dark Reading
Data Security Concerns Are Driving Changes in US Consumer Behavior and Demands
As consumers catch on to the dangers, protection could become a major topic for legislative bodies.
🕴 Phylum Expands Its Software Supply Chain Security Capabilities, Introduces Automated Vulnerability Reachability 🕴
📖 Read
via "Dark Reading".
Know what you need to fix today and what you don’t.📖 Read
via "Dark Reading".
Dark Reading
Phylum Expands Its Software Supply Chain Security Capabilities, Introduces Automated Vulnerability Reachability
Know what you need to fix today and what you don’t.
🗓️ Critical vulnerability allowed attackers to remotely unlock, control Hyundai, Genesis vehicles 🗓️
📖 Read
via "The Daily Swig".
Vehicles made after 2012 were vulnerable to web app exploit📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Critical vulnerability allowed attackers to remotely unlock, control Hyundai, Genesis vehicles
Vehicles made after 2012 were vulnerable to web app exploit
👍1
‼ CVE-2022-28607 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37016 ‼
📖 Read
via "National Vulnerability Database".
Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30528 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37017 ‼
📖 Read
via "National Vulnerability Database".
Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User Interface Password protection and Policy Import/Export Password protection, if it has been enabled.📖 Read
via "National Vulnerability Database".
🕴 IBM Cloud Supply Chain Vulnerability Showcases New Threat Class 🕴
📖 Read
via "Dark Reading".
The Hell's Keychain attack vector highlights common cloud misconfigurations and secrets exposure that can pose grave risk to enterprise customers.📖 Read
via "Dark Reading".
Dark Reading
IBM Cloud Supply Chain Vulnerability Showcases New Threat Class
The Hell's Keychain attack vector highlights common cloud misconfigurations and secrets exposure that can pose grave risk to enterprise customers.
🕴 Is MFA the Vegetable of Cybersecurity? 🕴
📖 Read
via "Dark Reading".
Don’t fuss now — another helping of multifactor authentication can keep your organization strong and its data safer.📖 Read
via "Dark Reading".
Dark Reading
Is MFA the Vegetable of Cybersecurity?
Multifactor authentification is crucial for creating a healthy cybersecurity posture, but many companies are slow to adopt.
⚠ Serious Security: MD5 considered harmful – to the tune of $600,000 ⚠
📖 Read
via "Naked Security".
It's not just the hashing, by the way. It's the salting and the stretching, too!📖 Read
via "Naked Security".
Naked Security
Serious Security: MD5 considered harmful – to the tune of $600,000
It’s not just the hashing, by the way. It’s the salting and the stretching, too!
‼ CVE-2022-4257 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631.📖 Read
via "National Vulnerability Database".
⚠ The CHRISTMA EXEC network worm – 35 years and counting! ⚠
📖 Read
via "Naked Security".
"Uh-oh, this viruses-and-worms scene could turn out quite troublesome." If only we'd been wrong...📖 Read
via "Naked Security".
Naked Security
The CHRISTMA EXEC network worm – 35 years and counting!
“Uh-oh, this viruses-and-worms scene could turn out quite troublesome.” If only we’d been wrong…
⚠ S3 Ep111: The business risk of a sleazy “nudity unfilter” [Audio + Text] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now (or read if you prefer)...📖 Read
via "Naked Security".
Naked Security
S3 Ep111: The business risk of a sleazy “nudity unfilter” [Audio + Text]
Latest episode – listen now (or read if you prefer)…