‼ CVE-2023-41034 ‼
📖 Read
via "National Vulnerability Database".
Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41044 ‼
📖 Read
via "National Vulnerability Database".
Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default `data_dir` in operating system packages (DEB, RPM) is set to `/var/lib/graylog-server`. The data directory for the Support Bundle feature is always `<data_dir>/support-bundle`. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a `/var/lib/graylog-server/support-bundle` directory name. The vulnerability would allow the download or deletion of files in the following example directories: `/var/lib/graylog-server/support-bundle-test` and `/var/lib/graylog-server/support-bundlesdirectory`. For the Graylog Docker images, the `data_dir` is set to `/usr/share/graylog/data` by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. `GET /api/system/debug/support/bundle/download/{filename}` and `DELETE /api/system/debug/support/bundle/{filename}`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41745 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41747 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40214 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2022. Notes: none.📖 Read
via "National Vulnerability Database".
🕴 Insurance Costs Rise, Coverage Shrinks, But Policies Remain Essential 🕴
📖 Read
via "Dark Reading".
The number of companies that have used their cyber insurance policies multiple times rises, but policy coverage grows more expensive and less comprehensive.📖 Read
via "Dark Reading".
Dark Reading
Insurance Costs Rise, Coverage Shrinks, but Policies Remain Essential
The number of companies that have used their cyber insurance policies multiple times rises, but policy coverage grows more expensive and less comprehensive.
🕴 UN: Southeast Asia Gangs Are Trafficking Cybercrime Workers 🕴
📖 Read
via "Dark Reading".
Cybercrime syndicates are forcing people into working for them, and it's a difficult issue to solve, involving digital platforms, political powers, and organized crime on a global scale.📖 Read
via "Dark Reading".
Dark Reading
UN: Southeast Asia Gangs Are Trafficking Cybercrime Workers
Cybercrime syndicates are forcing people into working for them, and it's a difficult issue to solve, involving digital platforms, political powers, and organized crime on a global scale.
🕴 3 out of 4 Cyberattacks in the Education Sector Are Associated With a Compromised On‑Premises User or Admin Account 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
3 out of 4 Cyberattacks in the Education Sector Are Associated With a Compromised On‑Premises User or Admin Account
FRISCO, Texas, Aug. 31, 2023 /PRNewswire/ -- Netwrix, a cybersecurity vendor that makes data security easy, today revealed additional findings for the education sector from its survey of 1,610 IT and security professionals from more than 100 countries.
🕴 National Cybersecurity Alliance Receives 200K Grant From Craig Newmark Philanthropies for HBCU Cybersecurity Program 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
National Cybersecurity Alliance Receives 200K Grant From Craig Newmark Philanthropies for HBCU Cybersecurity Program
August 28, 2023- WASHINGTON - The National Cybersecurity Alliance (NCA) today announced it has received a significant boost in funding from Craig Newmark Philanthropies. The $200,000 grant will support ongoing initiatives within NCA's Historically Black Colleges…
‼ CVE-2023-41751 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39351 ‼
📖 Read
via "National Vulnerability Database".
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4688 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39354 ‼
📖 Read
via "National Vulnerability Database".
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46869 ‼
📖 Read
via "National Vulnerability Database".
Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4299 ‼
📖 Read
via "National Vulnerability Database".
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41750 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39352 ‼
📖 Read
via "National Vulnerability Database".
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39356 ‼
📖 Read
via "National Vulnerability Database".
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41749 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979.📖 Read
via "National Vulnerability Database".