‼ CVE-2022-4501 ‼
📖 Read
via "National Vulnerability Database".
The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.2.7. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2601 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46343 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47411 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47408 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47406 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3106 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3107 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4283 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46342 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46340 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3108 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3917 ‼
📖 Read
via "National Vulnerability Database".
Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attacker with local access to read partition or RAM data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47410 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3115 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46341 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.📖 Read
via "National Vulnerability Database".
📢 WithSecure Elements Endpoint Protection review: Holistic protection at a great price 📢
📖 Read
via "ITPro".
Smart cloud-hosted security offering affordable endpoint protection for a wide range of devices at a good price📖 Read
via "ITPro".
ITPro
WithSecure Elements Endpoint Protection review: Holistic protection at a great price
Smart cloud-hosted security offering affordable endpoint protection for a wide range of devices at a good price
📢 Apple issues fix for ‘actively exploited’ WebKit zero-day vulnerability 📢
📖 Read
via "ITPro".
The update marks the 10th fix for zero-day vulnerabilities this year📖 Read
via "ITPro".
ITPro
Apple issues fix for ‘actively exploited’ WebKit zero-day vulnerability
The update marks the 10th fix for zero-day vulnerabilities this year
📢 Beyond Identity strikes up strategic partnership with World Wide Technology 📢
📖 Read
via "ITPro".
WWT will implement Beyond Identity’s authentication platform internally while also acting as a global channel partner📖 Read
via "ITPro".
channelpro
Beyond Identity strikes up strategic partnership with World Wide Technology
WWT will implement Beyond Identity’s authentication platform internally while also acting as a global channel partner
📢 Uber says compromised third-party to blame for data breach 📢
📖 Read
via "ITPro".
Vulnerable third-party vendor Teqtivity sparks second major incident for Uber in the space of three months📖 Read
via "ITPro".
ITPro
Uber says compromised third-party to blame for data breach
Vulnerable third-party vendor Teqtivity sparks second major incident for Uber in the space of three months
📢 How to implement strong authentication 📢
📖 Read
via "ITPro".
Strong authentication is hugely important, but implementing any regime at scale is not without its challenges📖 Read
via "ITPro".
ITPro
Implementing strong authentication across your business
Strong authentication is hugely important, but implementing any regime at scale is not without its challenges