‼ CVE-2023-37256 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs.📖 Read
via "National Vulnerability Database".
♟️ Russian Cybersecurity Executive Arrested for Alleged Role in 2012 Megahacks ♟️
📖 Read
via "Krebs on Security".
Nikita Kislitsin, formerly the head of network security for one of Russia's top cybersecurity firms, was arrested last week in Kazakhstan in response to 10-year-old hacking charges from the U.S. Department of Justice. Experts say Kislitsin's prosecution could soon put the Kazakhstan government in a sticky diplomatic position, as the Kremlin is already signaling that it intends to block his extradition to the United States.📖 Read
via "Krebs on Security".
Krebs on Security
Russian Cybersecurity Executive Arrested for Alleged Role in 2012 Megahacks
Nikita Kislitsin, formerly the head of network security for one of Russia's top cybersecurity firms, was arrested last week in Kazakhstan in response to 10-year-old hacking charges from the U.S. Department of Justice. Experts say Kislitsin's prosecution could…
🕴 AI-Enabled Voice Cloning Anchors Deepfaked Kidnapping 🕴
📖 Read
via "Dark Reading".
Virtual kidnapping is just one of many new artificial intelligence attack types that threat actors have begun deploying, as voice cloning emerges as a potent new imposter tool.📖 Read
via "Dark Reading".
Dark Reading
AI-Enabled Voice Cloning Anchors Deepfaked Kidnapping
Virtual kidnapping is just one of many new artificial intelligence attack types that threat actors have begun deploying, as voice cloning emerges as a potent new imposter tool.
🕴 OTORIO Rolls Out Advanced Attack Graph Analysis for OT Security 🕴
📖 Read
via "Dark Reading".
Innovative risk-based model enables better security measures.📖 Read
via "Dark Reading".
Dark Reading
OTORIO Rolls Out Advanced Attack Graph Analysis for OT Security
Innovative risk-based model enables better security measures.
🕴 Mend.io Launches Inaugural Open Source Reliability Leaderboard 🕴
📖 Read
via "Dark Reading".
New report offers valuable resource to help organizations evaluate the safety and reliability of open-source packages.📖 Read
via "Dark Reading".
Dark Reading
Mend.io Launches Inaugural Open Source Reliability Leaderboard
New report offers valuable resource to help organizations evaluate the safety and reliability of open-source packages.
🕴 Invary Raises $1.85M in Pre-Seed Funding to Close Critical Gap in Zero Trust Security 🕴
📖 Read
via "Dark Reading".
The company introduces a solution to restore trust in customers' existing cyber defense techstack.📖 Read
via "Dark Reading".
Dark Reading
Invary Raises $1.85M in Pre-Seed Funding to Close Critical Gap in Zero Trust Security
The company introduces a solution to restore trust in customers' existing cyber defense techstack.
🕴 Cybellum Unveils New Brand, Amplifying Commitment to Team-Centric Product Security 🕴
📖 Read
via "Dark Reading".
The new brand is launched alongside new product security platform capabilities such as a vulnerability management (VM) co-pilot and incident response investigation management, providing automation and workflows for the many teams involved in product security.📖 Read
via "Dark Reading".
Dark Reading
Cybellum Unveils New Brand, Amplifying Commitment to Team-Centric Product Security
The new brand is launched alongside new product security platform capabilities such as a vulnerability management (VM) co-pilot and incident response investigation management, providing automation and workflows for the many teams involved in product security.
❤1👍1
🕴 Employer Demand for Technology Workers Across Europe Remains on Firm Footing 🕴
📖 Read
via "Dark Reading".
More than 950,000 job postings for tech positions in Q4 2022.📖 Read
via "Dark Reading".
Dark Reading
Employer Demand for Technology Workers Across Europe Remains on Firm Footing
More than 950,000 job postings for tech positions in Q4 2022.
🕴 WatchGuard Threat Lab Report Reveals New Browser-Based Social Engineering Trends 🕴
📖 Read
via "Dark Reading".
Key findings from the research also show three of the four new malware threats on this quarter's top-ten list originated in China and Russia, living-off-the-land attacks on the rise, and more.📖 Read
via "Dark Reading".
Dark Reading
WatchGuard Threat Lab Report Reveals New Browser-Based Social Engineering Trends
Key findings from the research also show three of the four new malware threats on this quarter's top-ten list originated in China and Russia, living-off-the-land attacks on the rise, and more.
🕴 TXOne Networks' Stellar Solution Safeguards Operational Stability for Organizations in Various Industries 🕴
📖 Read
via "Dark Reading".
Stellar leverages cyber physical system detection and response (CPSDR) to prevent unexpected system changes from impacting operational reliability and availability.📖 Read
via "Dark Reading".
Dark Reading
TXOne Networks' Stellar Solution Safeguards Operational Stability for Organizations in Various Industries
Stellar leverages cyber physical system detection and response (CPSDR) to prevent unexpected system changes from impacting operational reliability and availability.
🕴 Center for Internet Security, CREST Join Forces to Secure Organizations Globally 🕴
📖 Read
via "Dark Reading".
New program provides organizations a way to show customers and partners their cybersecurity posture meets rigorous standards of CREST accreditation.📖 Read
via "Dark Reading".
Dark Reading
Center for Internet Security, CREST Join Forces to Secure Organizations Globally
New program provides organizations a way to show customers and partners their cybersecurity posture meets rigorous standards of CREST accreditation.
🕴 Pepper and Embedded Insurance Partner on Cyber Insurance For Consumers, SMBs 🕴
📖 Read
via "Dark Reading".
Now, if you've got an IoT network powered by Pepper, you can insure it through Embedded Insurance — even if your business is too small to support a SOC.📖 Read
via "Dark Reading".
Dark Reading
Pepper and Embedded Insurance Partner on Cyber Insurance for Consumers, SMBs
If you have an IoT network powered by Pepper, you can now insure it through Embedded Insurance — even if your business is too small to support a SOC.
‼ CVE-2022-44720 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26708 ‼
📖 Read
via "National Vulnerability Database".
requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36471 ‼
📖 Read
via "National Vulnerability Database".
Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println("Hello from Groovy!")" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36469 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25433 ‼
📖 Read
via "National Vulnerability Database".
libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35938 ‼
📖 Read
via "National Vulnerability Database".
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3465 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-232711.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2020-26709 ‼
📖 Read
via "National Vulnerability Database".
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36470 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote code execution. There are different attack vectors, the simplest is the Velocity code in the icon set's HTML or XWiki syntax definition. The [icon picker](https://extensions.xwiki.org/xwiki/bin/view/Extension/Icon%20Theme%20Application#HIconPicker) can be used to trigger the rendering of any icon set. The XWiki syntax variant of the icon set is also used without any escaping in some documents, allowing to inject XWiki syntax including script macros into a document that might have programming right, for this the currently used icon theme needs to be edited. Further, the HTML output of the icon set is output as JSON in the icon picker and this JSON is interpreted as XWiki syntax, allowing again the injection of script macros into a document with programming right and thus allowing remote code execution. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This issue has been patched in XWiki 14.10.6 and 15.1. Icon themes now require script right and the code in the icon theme is executed within the context of the icon theme, preventing any rights escalation. A macro for displaying icons has been introduced to avoid injecting the raw wiki syntax of an icon set into another document. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".