‼ CVE-2023-26056 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
🕴 BlackLotus Bookit Found Targeting Windows 11 🕴
📖 Read
via "Dark Reading".
Sold for around $5,000 in hacking forums, the BlackLotus UEFI bootkit is capable of targeting even updated systems, researchers find.📖 Read
via "Dark Reading".
Dark Reading
BlackLotus Bookit Found Targeting Windows 11
Sold for around $5,000 in hacking forums, the BlackLotus UEFI bootkit is capable of targeting even updated systems, researchers find.
🕴 Biden's Cybersecurity Strategy Calls for Software Liability, Tighter Critical Infrastructure Security 🕴
📖 Read
via "Dark Reading".
The new White House plan outlines proposed minimum security requirements in critical infrastructure — and for shifting liability for software products to vendors.📖 Read
via "Dark Reading".
Dark Reading
Biden's Cybersecurity Strategy Calls for Software Liability, Tighter Critical Infrastructure Security
The new White House plan outlines proposed minimum security requirements in critical infrastructure — and for shifting liability for software products to vendors.
🕴 CISA, MITRE Look to Take ATT&CK Framework Out of the Weeds 🕴
📖 Read
via "Dark Reading".
The Decider tool is designed to make the ATT&CK framework more accessible and usable for security analysts of every level, with an intuitive interface and simplified language.📖 Read
via "Dark Reading".
Dark Reading
CISA, MITRE Look to Take ATT&CK Framework Out of the Weeds
The Decider tool is designed to make the ATT&CK framework more accessible and usable for security analysts of every level, with an intuitive interface and simplified language.
‼ CVE-2023-1101 ‼
📖 Read
via "National Vulnerability Database".
SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22381 ‼
📖 Read
via "National Vulnerability Database".
A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. To exploit this vulnerability, an attacker would need existing permission to control the value of environment variables for use with GitHub Actions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.8.0 and was fixed in versions 3.4.15, 3.5.12, 3.6.8, 3.7.5. This vulnerability was reported via the GitHub Bug Bounty program.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0656 ‼
📖 Read
via "National Vulnerability Database".
A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35645 ‼
📖 Read
via "National Vulnerability Database".
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230958.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46501 ‼
📖 Read
via "National Vulnerability Database".
Accruent LLC Maintenance Connection 2021 (all) & 2022.2 was discovered to contain a SQL injection vulnerability via the E-Mail to Work Order function.📖 Read
via "National Vulnerability Database".
🕴 Axis Security Acquisition Strengthens Aruba's SASE Solutions With Integrated Cloud Security and SD-WAN 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Axis Security Acquisition Strengthens Aruba's SASE Solutions With Integrated Cloud Security and SD-WAN
HOUSTON, Texas – March 2, 2023 – Hewlett Packard Enterprise (NYSE: HPE) today announced that it entered into a definitive agreement to acquire Axis Security, a cloud security provider. This acquisition will allow HPE to expand its edge-to-cloud security capabilities…
‼ CVE-2022-40633 ‼
📖 Read
via "National Vulnerability Database".
A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks.📖 Read
via "National Vulnerability Database".
♟️ Highlights from the New U.S. Cybersecurity Strategy ♟️
📖 Read
via "Krebs on Security".
The Biden administration today issued its vision for beefing up the nation's collective cybersecurity posture, including calls for legislation establishing liability for software products and services that are sold with little regard for security. The White House's new national cybersecurity strategy also envisions a more active role by cloud providers and the U.S. military in disrupting cybercriminal infrastructure, and names China as the single biggest cyber threat to U.S. interests.📖 Read
via "Krebs on Security".
Krebs on Security
Highlights from the New U.S. Cybersecurity Strategy
The Biden administration today issued its vision for beefing up the nation's collective cybersecurity posture, including calls for legislation establishing liability for software products and services that are sold with little regard for security. The White…
🔥1
🕴 IBM Contributes Supply Chain Security Tools to OWASP 🕴
📖 Read
via "Dark Reading".
License Scanner and SBOM Utility will boost the capabilities of OWASP's CycloneDX Software Bill of Materials standard.📖 Read
via "Dark Reading".
Dark Reading
IBM Contributes Supply Chain Security Tools to OWASP
License Scanner and SBOM Utility will boost the capabilities of OWASP's CycloneDX Software Bill of Materials standard.
‼ CVE-2023-1160 ‼
📖 Read
via "National Vulnerability Database".
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0457 ‼
📖 Read
via "National Vulnerability Database".
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U(C) CPU modules all models all versions, FX5UJ CPU modules all models all versions, FX5S CPU modules all models all versions, FX5-ENET all versions and FX5-ENET/IP all versions allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.📖 Read
via "National Vulnerability Database".
📢 CISA: Tech industry 'shouldn't tolerate' Patch Tuesday 📢
📖 Read
via "ITPro".
CISA director Jen Easterly said the tech industry has allowed the widespread acceptance of "deviant behaviours" to make a mockery of cyber security📖 Read
via "ITPro".
ITPro
CISA: Tech industry 'shouldn't tolerate' Patch Tuesday, unsecured software
CISA director Jen Easterly said the tech industry has allowed the widespread acceptance of "deviant behaviours" to make a mockery of cyber security
📢 Uncovering the ransomware threat from global supply chains 📢
📖 Read
via "ITPro".
Everything is connected📖 Read
via "ITPro".
ITPro
Uncovering the ransomware threat from global supply chains
Everything is connected
👍1
📢 Leaked today, exploited for life 📢
📖 Read
via "ITPro".
How social media biometric patterns affect your future📖 Read
via "ITPro".
ITPro
Leaked today, exploited for life
How social media biometric patterns affect your future
📢 The near and far future of ransomware business models 📢
📖 Read
via "ITPro".
What would make ransomware actors change their criminal business models?📖 Read
via "ITPro".
ITPro
The near and far future of ransomware business models
What would make ransomware actors change their criminal business models?
📢 Trend Micro security predictions for 2023 📢
📖 Read
via "ITPro".
Prioritise cyber security strategies on capabilities rather than costs📖 Read
via "ITPro".
ITPro
Trend Micro security predictions for 2023
Prioritise cyber security strategies on capabilities rather than costs
📢 Bitdefender releases free MortalKombat ransomware decryptor tool 📢
📖 Read
via "ITPro".
While still a relatively new strain, MortalKombat has been used extensively to target users and steal cryptocurrency📖 Read
via "ITPro".
ITPro
Bitdefender releases free MortalKombat ransomware decryptor tool
While still a relatively new strain, MortalKombat has been used extensively to target users and steal cryptocurrency