CVE-2021-43762

CVE-2021-43762 affects Adobe Experience Manager (AEM) Cloud Service and on‑prem 6.5.10.0 and earlier, via a dispatcher bypass that could bypass security controls and expose sensitive areas of the web app. The issue is documented across multiple sources (NVD/NVDA, Nessus APSB21-103). Remediation i...

Mitsubishi Electric MELSEC-F Series security vulnerabilities

The Mitsubishi Electric MELSEC-F Series is a basic micro PLC with scalable analog and communication functions for industrial control devices from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC-F Series that stems from a lack of administrative controls...

Snipe-IT Access Control Vulnerability

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, which stems from the presence of improper access controls in the software. No details of the vulnerability are currently available...

CVE-2021-43762: Improper Input Validation

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability...

GHSA-QC9X-GJCV-465W Pipenv's requirements.txt parsing allows malicious index url in comments

Issue Summary Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file e.g. with "pipenv install -r requirements.txt...

Faking an iPhone Reboot

Researchers have figured how how to intercept and fake an iPhone reboot: Well dissect the iOS system and show how its possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, its still running. The "NoReboot" approach...

Johnson Controls VideoEdge security vulnerability

Johnson Controls VideoEdge is a security solution from Johnson Controls, Inc. A security vulnerability exists in Johnson Controls VideoEdge that could result in a denial of service...

PT-2022-1521 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access controls in the Windows GDI+ component, which can be exploited to disclose protected information. This can allow an attacker to obtain sensitive...

Johnson Controls VideoEdge

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc. Equipment: VideoEdge Vulnerability: Improper Handling of Syntactically Invalid Structure= 2. RISK EVALUATION Running a vulnerability...

The 2021 Naughty and Nice Lists: Cybersecurity Edition

Editor’s note: We had planned to publish our Hacky Holidays blog series throughout December 2021 – but then Log4Shell happened, and we dropped everything to focus on this major vulnerability that impacted the entire cybersecurity community worldwide. Now that it’s 2022, we’re feeling in need of...

CVE-2021-42748

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

CVE-2021-42748

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

Security feature bypass

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

Apache Log4j2 JNDI RCE

The vulnerability of the Apache Log4j2 Java-programming logging library is related to the absence of additional JNDI control elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using JDBC Appender...

Facebook Launches 'Privacy Center' to Educate Users on Data Collection and Privacy Options

Meta Platforms, the company formerly known as Facebook, on Friday announced the launch of a centralized Privacy Center that aims to "educate people" about its approach with regards to how it collects and processes personal information across its family of social media apps. "Privacy Center provid...

CVE-2021-42748

CVE-2021-42748 affects Beaver Builder up to version 2.5.0.3. The issue allows attackers to bypass the visibility controls protection mechanism via the REST API, enabling unauthorized exposure of content. The vulnerability’s root cause is a bypass of visibility controls in REST API handling, with ...

CVE-2021-42748

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

CVE-2021-42748: Direct Request

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

PT-2022-11674 · Unknown · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions prior to 2.5.0.4 Description: The issue allows attackers to bypass the visibility controls protection mechanism. This can be achieved via the REST API. Recommendations: For versions prior to 2.5.0.4, update to version...

PT-2022-1813 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to insufficient access controls in Microsoft Edge, allowing a remote attacker to elevate privileges in the system. This can enable the execution o...