‼ CVE-2022-4108 ‼
📖 Read
via "National Vulnerability Database".
The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3986 ‼
📖 Read
via "National Vulnerability Database".
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4125 ‼
📖 Read
via "National Vulnerability Database".
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36619 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4058 ‼
📖 Read
via "National Vulnerability Database".
The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4124 ‼
📖 Read
via "National Vulnerability Database".
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them📖 Read
via "National Vulnerability Database".
🕴 Bugcrowd Launches Bug Bounty Program for Australian-Based Navitas 🕴
📖 Read
via "Dark Reading".
Leading global education provider engages with Bugcrowd Security Researchers to identify threats.📖 Read
via "Dark Reading".
Dark Reading
Bugcrowd Launches Bug Bounty Program for Australian-Based Navitas
Leading global education provider engages with Bugcrowd Security Researchers to identify threats.
🕴 Security Skills Command Premiums in Tight Market 🕴
📖 Read
via "Dark Reading".
Recession fears notwithstanding, cybersecurity skills — both credentialed and noncredentialed — continue to attract higher pay and more job security.📖 Read
via "Dark Reading".
Dark Reading
Security Skills Command Premiums in Tight Market
Recession fears notwithstanding, cybersecurity skills — both credentialed and noncredentialed — continue to attract higher pay and more job security.
📢 The IT Pro Podcast: Surveying today's threat landscape 📢
📖 Read
via "ITPro".
With an expanding attack surface, can you afford to neglect detection in favour of response?📖 Read
via "ITPro".
ITPro
The IT Pro Podcast: Surveying today's threat landscape
With an expanding attack surface, can you afford to neglect detection in favour of response?
📢 Podcast transcript: Surveying today's threat landscape 📢
📖 Read
via "ITPro".
Read the full transcript for this episode of the IT Pro Podcast📖 Read
via "ITPro".
ITPro
Podcast transcript: Surveying today's threat landscape
Read the full transcript for this episode of the IT Pro Podcast
📢 World Cup security expert says devices have "a huge potential to be abused” 📢
📖 Read
via "ITPro".
As audiences prepare for the World Cup final, fans have been urged to remain vigilant for cyber threats and potential disruption📖 Read
via "ITPro".
ITPro
World Cup security expert says devices have "a huge potential to be abused”
As audiences prepare for the World Cup final, fans have been urged to remain vigilant for cyber threats and potential disruption
📢 Asian countries dominate list of least cyber-secure remote working locations 📢
📖 Read
via "ITPro".
The research aimed to highlight the security risks of post-pandemic 'workations'📖 Read
via "ITPro".
ITPro
Asian countries dominate list of least cyber-secure remote working locations
The research aimed to highlight the security risks of post-pandemic 'workations'
📢 “High severity” vulnerabilities uncovered in three-quarters of operational technology systems 📢
📖 Read
via "ITPro".
OT vulnerabilities could be putting national infrastructure at risk, Microsoft warned📖 Read
via "ITPro".
ITPro
“High severity” vulnerabilities uncovered in three-quarters of operational technology systems
OT vulnerabilities could be putting national infrastructure at risk, Microsoft warned
📢 US begins seizure of 48 DDoS-for-hire services following global investigation 📢
📖 Read
via "ITPro".
Six people have been arrested who allegedly oversaw computer attacks launched using booters📖 Read
via "ITPro".
ITPro
US begins seizure of 48 DDoS-for-hire services following global investigation
Six people have been arrested who allegedly oversaw computer attacks launched using booters
‼ CVE-2022-4610 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4612 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216274 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-42947 ‼
📖 Read
via "National Vulnerability Database".
A maliciously crafted X_B file when parsed through Autodesk Maya 2023 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4613 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216275.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31683 ‼
📖 Read
via "National Vulnerability Database".
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4611 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28173 ‼
📖 Read
via "National Vulnerability Database".
The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.📖 Read
via "National Vulnerability Database".