‼ CVE-2022-29837 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3226 ‼
📖 Read
via "National Vulnerability Database".
An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall older than version 19.5 GA.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41297 ‼
📖 Read
via "National Vulnerability Database".
IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3710 ‼
📖 Read
via "National Vulnerability Database".
A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall older than version 19.5 GA.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2969 ‼
📖 Read
via "National Vulnerability Database".
Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3711 ‼
📖 Read
via "National Vulnerability Database".
A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall older than version 19.5 GA.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3713 ‼
📖 Read
via "National Vulnerability Database".
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall older than version 19.5 GA.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3709 ‼
📖 Read
via "National Vulnerability Database".
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall older than version 19.5 GA.📖 Read
via "National Vulnerability Database".
♟️ ConnectWise Quietly Patches Flaw That Helps Phishers ♟️
📖 Read
via "Krebs on Security".
ConnectWise, a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs), is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The warning comes just days after the company quietly patched a vulnerability that makes it easier for phishers to launch these attacks.📖 Read
via "Krebs on Security".
Krebs on Security
ConnectWise Quietly Patches Flaw That Helps Phishers
ConnectWise, a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs), is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients…
🕴 One Year After Log4Shell, Most Firms Are Still Exposed to Attack 🕴
📖 Read
via "Dark Reading".
Though there have been fewer than expected publicly reported attacks involving the vulnerability, nearly three-quarters of organizations remain exposed to it.📖 Read
via "Dark Reading".
Dark Reading
One Year After Log4Shell, Most Firms Are Still Exposed to Attack
Though there have been fewer than expected publicly reported attacks involving the vulnerability, nearly three-quarters of organizations remain exposed to it.
‼ CVE-2022-43901 ‼
📖 Read
via "National Vulnerability Database".
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vulnerability to possibly gain information to other IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps components. IBM X-Force ID: 240829.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43900 ‼
📖 Read
via "National Vulnerability Database".
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound network connection to another system. IBM X-Force ID: 240827.📖 Read
via "National Vulnerability Database".
🕴 Artifact Poisoning in GitHub Actions Imports Malware via Software Pipelines 🕴
📖 Read
via "Dark Reading".
A vulnerability discovered in GitHub Actions could allow an attacker to poison a developer's pipeline, highlighting the risk that insecure software pipelines pose.📖 Read
via "Dark Reading".
Dark Reading
Artifact Poisoning in GitHub Actions Imports Malware via Software Pipelines
A vulnerability discovered in GitHub Actions could allow an attacker to poison a developer's pipeline, highlighting the risk that insecure software pipelines pose.
🕴 LastPass Discloses Second Breach in Three Months 🕴
📖 Read
via "Dark Reading".
The threat actor behind an August intrusion used data from that incident to access customer data stored with a third-party cloud service provider, and affiliate GoTo reports breach of development environment.📖 Read
via "Dark Reading".
Dark Reading
LastPass Discloses Second Breach in Three Months
The threat actor behind an August intrusion used data from that incident to access customer data stored with a third-party cloud service provider, and affiliate GoTo reports breach of development environment.
⚠ The CHRISTMA EXEC network worm – 35 years and counting! ⚠
📖 Read
via "Naked Security".
"Uh-oh, this viruses-and-worms scene could turn out quite troublesome." If only we'd been wrong...📖 Read
via "Naked Security".
Naked Security
The CHRISTMA EXEC network worm – 35 years and counting!
“Uh-oh, this viruses-and-worms scene could turn out quite troublesome.” If only we’d been wrong…
⚠ S3 Ep111: The business risk of a sleazy “nudity unfilter” [Audio + Text] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now (or read if you prefer)...📖 Read
via "Naked Security".
Naked Security
S3 Ep111: The business risk of a sleazy “nudity unfilter” [Audio + Text]
Latest episode – listen now (or read if you prefer)…
⚠ LastPass admits to customer data breach caused by previous breach ⚠
📖 Read
via "Naked Security".
Seems that the developer account that the crooks breached last time gave indirect access to customer data this time round.📖 Read
via "Naked Security".
Naked Security
LastPass admits to customer data breach caused by previous breach
Seems that the developer account that the crooks breached last time gave indirect access to customer data this time round.
‼ CVE-2022-45562 ‼
📖 Read
via "National Vulnerability Database".
Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privilege, this can lead to change hardware settings and execute arbitrary commands in vulnerable system functions that is requires high privilege to access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-44928 ‼
📖 Read
via "National Vulnerability Database".
D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43325 ‼
📖 Read
via "National Vulnerability Database".
An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers to execute arbitrary commands via a crafted payload injected into the license input.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-44929 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles.📖 Read
via "National Vulnerability Database".