⚠ Microsoft fixes two 0-days on Patch Tuesday – update now! ⚠
📖 Read
via "Naked Security".
An email you haven't even looked at yet could be used to trick your mail server into helping crooks to logon as you.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-1327 ‼
📖 Read
via "National Vulnerability Database".
Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password.📖 Read
via "National Vulnerability Database".
🕴 How Patch Tuesday Keeps the Beat After 20 Years 🕴
📖 Read
via "Dark Reading".
Patch Tuesday turned security updates from chaotic events into a routine. Here's how we got here, and where things might be heading.📖 Read
via "Dark Reading".
Dark Reading
How Patch Tuesday Keeps the Beat After 20 Years
Patch Tuesday turned security updates from chaotic events into a routine. Here's how we got here and where things might be heading.
♟️ Two U.S. Men Charged in 2022 Hacking of DEA Portal ♟️
📖 Read
via "Krebs on Security".
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government email accounts to publicly threaten and extort their victims.📖 Read
via "Krebs on Security".
Krebs on Security
Two U.S. Men Charged in 2022 Hacking of DEA Portal
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in…
‼ CVE-2023-27235 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1407 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-27239 ‼
📖 Read
via "National Vulnerability Database".
Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27240 ‼
📖 Read
via "National Vulnerability Database".
Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27234 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.📖 Read
via "National Vulnerability Database".
🕴 Are We Doing Enough to Protect Our Unstructured Data? 🕴
📖 Read
via "Dark Reading".
Organizations are coming under pressure to protect their data, but does all data need the same security? To secure it, you first need to know what and where it is.📖 Read
via "Dark Reading".
Dark Reading
Are We Doing Enough to Protect Our Unstructured Data?
Organizations are coming under pressure to protect their data, but does all data need the same security? To secure it, you first need to know what and where it is.
🕴 SMBs Orgs Want Help, but Cybersecurity Expertise Is Scarce 🕴
📖 Read
via "Dark Reading".
Smaller firms are boosting cybersecurity budgets, but there's a long way to go to address a deep lack of cyber preparedness among SMBs.📖 Read
via "Dark Reading".
Dark Reading
SMBs Orgs Want Help, but Cybersecurity Expertise Is Scarce
Smaller firms are boosting cybersecurity budgets, but there's a long way to go to address a deep lack of cyber preparedness among SMBs.
‼ CVE-2022-45155 ‼
📖 Read
via "National Vulnerability Database".
An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0322 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS.This issue affects UNIS: before 28376.📖 Read
via "National Vulnerability Database".
🕴 Why Security Practitioners Should Understand Their Business 🕴
📖 Read
via "Dark Reading".
The sooner CISOs become proactive in understanding the flip side of the organizations they protect, the better they'll be at their jobs.📖 Read
via "Dark Reading".
Dark Reading
Why Security Practitioners Should Understand Their Business
The sooner CISOs become proactive in understanding the flip side of the organizations they protect, the better they'll be at their jobs.
♟️ Microsoft Patch Tuesday, March 2023 Edition ♟️
📖 Read
via "Krebs on Security".
Microsoft on Tuesday released updates to quash at least 74 security bugs in its Windows operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in Microsoft Outlook that can be exploited without any user interaction.📖 Read
via "Krebs on Security".
Krebs on Security
Microsoft Patch Tuesday, March 2023 Edition
Microsoft on Tuesday released updates to quash at least 74 security bugs in its Windows operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in Microsoft Outlook that can be exploited…
‼ CVE-2023-24729 ‼
📖 Read
via "National Vulnerability Database".
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27781 ‼
📖 Read
via "National Vulnerability Database".
jpegoptim v1.5.2 was discovered to contain a heap overflow in the optimize function at jpegoptim.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0100 ‼
📖 Read
via "National Vulnerability Database".
In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27103 ‼
📖 Read
via "National Vulnerability Database".
Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24732 ‼
📖 Read
via "National Vulnerability Database".
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-44580 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection (SQLi) vulnerability in RichPlugins Plugin for Google Reviews plugin <= 2.2.3 versions.📖 Read
via "National Vulnerability Database".