‼ CVE-2022-0553 ‼
📖 Read
via "National Vulnerability Database".
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3966 ‼
📖 Read
via "National Vulnerability Database".
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22947 ‼
📖 Read
via "National Vulnerability Database".
** DISPUTED ** Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43390 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22959 ‼
📖 Read
via "National Vulnerability Database".
WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43389 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22945 ‼
📖 Read
via "National Vulnerability Database".
In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48253 ‼
📖 Read
via "National Vulnerability Database".
nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerability occurs when the homedirs option is used.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22958 ‼
📖 Read
via "National Vulnerability Database".
The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47866 ‼
📖 Read
via "National Vulnerability Database".
Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-25073 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.7 is able to address this issue. The name of the patch is b3a3cd8efe2cd3bd3c5b3b7abf2fe80dbee51b77. It is recommended to upgrade the affected component. VDB-218002 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-42967 ‼
📖 Read
via "National Vulnerability Database".
Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47865 ‼
📖 Read
via "National Vulnerability Database".
Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4696 ‼
📖 Read
via "National Vulnerability Database".
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above📖 Read
via "National Vulnerability Database".
🕴 Infoblox Appoints Scott Harrell to CEO 🕴
📖 Read
via "Dark Reading".
Jesper Andersen has decided to retire and will continue to serve on the Board of Directors.📖 Read
via "Dark Reading".
Dark Reading
Infoblox Appoints Scott Harrell to CEO
Jesper Andersen has decided to retire and will continue to serve on the Board of Directors.
🕴 SecureAuth Announces Seven New Patents for Biobehavioral Credentials for Continuous Authentication, and ID Proofing to Secure Digital Identities 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
SecureAuth Announces Seven New Patents for Biobehavioral Credentials for Continuous Authentication, and ID Proofing to Secure Digital…
IRVINE, Calif. – January 11, 2023 – SecureAuth, a leader in next-generation access management and authentication, today announced that the United States Patent and Trademark Office (USPTO) has granted the company seven groundbreaking methods for authenticating…
🗓️ Threema disputes crypto flaws disclosure, prompts security flap 🗓️
📖 Read
via "The Daily Swig".
‘Condescending’ response to vulnerability disclosure angers infosec community📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Threema disputes crypto flaws disclosure, prompts security flap
‘Condescending’ response to vulnerability disclosure angers infosec community
👍2
🕴 Black Hat Flashback: The Deadly Consequences of Weak Medical Device Security 🕴
📖 Read
via "Dark Reading".
Hacking to kill: Dark Reading's Fahmida Y. Rashid reflects on the monumental Black Hat 2011 moment when Jay Radcliffe showed how to hack his insulin pump.📖 Read
via "Dark Reading".
Dark Reading
Black Hat Flashback: The Deadly Consequences of Weak Medical Device Security
Hacking to kill: Dark Reading's Fahmida Y. Rashid reflects on the monumental Black Hat 2011 moment when Jay Radcliffe showed how to hack his insulin pump.
🛠 I2P 2.1.0 🛠
📖 Read
via "Packet Storm Security".
I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version.📖 Read
via "Packet Storm Security".
Packetstormsecurity
I2P 2.1.0 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
👍2
‼ CVE-2022-47864 ‼
📖 Read
via "National Vulnerability Database".
Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2014-125074 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The name of the patch is f1249f438cd8c39e7ef2f6c8f2ab76b239a02fae. It is recommended to apply a patch to fix this issue. The identifier VDB-218005 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".