‼ CVE-2023-21670 ‼
📖 Read
via "National Vulnerability Database".
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.📖 Read
via "National Vulnerability Database".
🕴 ChatGPT Hallucinations Open Developers to Supply-Chain Malware Attacks 🕴
📖 Read
via "Dark Reading".
Attackers could exploit a common AI experience—false recommendations—to spread malicious code via developers that use ChatGPT to create software.📖 Read
via "Dark Reading".
Dark Reading
ChatGPT Hallucinations Open Developers to Supply Chain Malware Attacks
Attackers could exploit a common AI experience — false recommendations — to spread malicious code via developers that use ChatGPT to create software.
‼ CVE-2023-1779 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2833 ‼
📖 Read
via "National Vulnerability Database".
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_screen_options[option]' and 'wp_screen_options[value]' parameters during a screen option update.📖 Read
via "National Vulnerability Database".
🕴 US Aerospace Contractor Hacked With 'PowerDrop' Backdoor 🕴
📖 Read
via "Dark Reading".
Hackers used a little to do a lot, cracking a high-value target with hardly more than the living-off-the-land tools (PowerShell especially) found on any standard Windows computer.📖 Read
via "Dark Reading".
Dark Reading
US Aerospace Contractor Hacked With 'PowerDrop' Backdoor
Hackers used a little to do a lot, cracking a high-value target with hardly more than the living-off-the-land tools (PowerShell especially) found on any standard Windows computer.
❤2
🕴 Filling the Gaps: How to Secure the Future of Hybrid Work 🕴
📖 Read
via "Dark Reading".
By enhancing remote management and adopting hardware-enforced security, productivity can continue without inviting extra cyber-risk.📖 Read
via "Dark Reading".
Dark Reading
Filling the Gaps: How to Secure the Future of Hybrid Work
By enhancing remote management and adopting hardware-enforced security, productivity can continue without inviting extra cyber-risk.
‼ CVE-2023-20724 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07843845; Issue ID: ALPS07843841.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20733 ‼
📖 Read
via "National Vulnerability Database".
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645149.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20747 ‼
📖 Read
via "National Vulnerability Database".
In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue ID: ALPS07519121.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33532 ‼
📖 Read
via "National Vulnerability Database".
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30948 ‼
📖 Read
via "National Vulnerability Database".
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content.This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time.📖 Read
via "National Vulnerability Database".
⚠ Chrome zero-day: “This exploit is in the wild”, so check your version now ⚠
📖 Read
via "Naked Security".
Chrome 0-day patched now, Edge patch coming soon.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-0921 ‼
📖 Read
via "National Vulnerability Database".
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32281 ‼
📖 Read
via "National Vulnerability Database".
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds read in the FontManager. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33651 ‼
📖 Read
via "National Vulnerability Database".
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27126 ‼
📖 Read
via "National Vulnerability Database".
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.📖 Read
via "National Vulnerability Database".
🕴 Netskope Intelligent SSE Selected by Transdev to Secure and Connect its Hybrid Workforce 🕴
📖 Read
via "Dark Reading".
Implementation is part of Transdev's Cloud-First approach to better manage technological obsolescence.📖 Read
via "Dark Reading".
Dark Reading
Netskope Intelligent SSE Selected by Transdev to Secure and Connect its Hybrid Workforce
Implementation is part of Transdev's Cloud-First approach to better manage technological obsolescence.
🕴 ILTA and Conversant Group Release Cybersecurity Benchmarking Survey of the Legal Industry 🕴
📖 Read
via "Dark Reading".
Joint research highlights disconnect between legal IT and recommended cybersecurity practices.📖 Read
via "Dark Reading".
Dark Reading
ILTA and Conversant Group Release Cybersecurity Benchmarking Survey of the Legal Industry
Joint research highlights disconnect between legal IT and recommended cybersecurity practices.
🕴 With SEC Rule Changes on the Horizon, Research Reveals Only 14% of CISOs Have Traits Desired for Cyber Expert Board Positions 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
With SEC Rule Changes on the Horizon, Research Reveals Only 14% of CISOs Have Traits Desired for Cyber Expert Board Positions
BOSTON, June 6, 2023 /PRNewswire/ -- Today, IANS Research, Artico Search and The CAP Group released its CISO as Board Directors - CISO Board Readiness Analysis, a collaborative research study that evaluates the qualifications of Chief Information Security…
🕴 Verizon DBIR: Social Engineering Breaches Double, Leading to Spiraling Ransomware Costs 🕴
📖 Read
via "Dark Reading".
Ransomware continues its runaway growth with median payments reaching $50,000 per incident.📖 Read
via "Dark Reading".
Dark Reading
Verizon DBIR: Social Engineering Breaches Double, Leading to Spiraling Ransomware Costs
Ransomware continues its runaway growth with median payments reaching $50,000 per incident.
‼ CVE-2023-2603 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.📖 Read
via "National Vulnerability Database".