Vulnerability Management news and publications #1

Hello everyone! In this episode, I will try to revive Security News with a focus on Vulnerability Management. On the one hand, creating such reviews requires free time, which could be spent more wisely, for example, on open source projects or original research. On the other hand, there are...

Zero-day vulnerability in Chrome browser being exploited-in-the-wild

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The heap buffer overflow vulnerability in chrome browser let attackers to run arbitrary code or cause denial-of-service condition...

Attacker can take premium from taker who fill short-call orders for free.

Lines of code Vulnerability details Impact Takers who fill short-call orders may unable to exercise their long-call position. Attackers can abuse it to take premium from takers for free. In PuttyV2.fillOrder function, when taker fill short-call order, order’s maker only has to transfer erc20Asset...

TrueConf Server Cross-Site Scripting Vulnerability

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary HTML and script code in the user's browser...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

CVE-2022-1952

creationtimestamp| type| source ---|---|--- 2022-06-30 09:48:06+00:00| published-proof-of-concept| Telegram/NeKXnTM2sAZzsr0TQAi-bPyfhrvmFH-23PGtGnpZ0v7g30Y 2022-07-11 16:19:21+00:00| seen| https://t.me/cibsecurity/45914 2024-11-24 00:00:00+00:00| seen| The Shadowserver...

BigBlueButton has an unspecified vulnerability (CNVD-2022-82634)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. BigBlueButton Greenlight has a security vulnerability that could be exploited by an attacker to view the settings of any room...

#StopRansomware: MedusaLocker

CISA, the Federal Bureau of Investigation FBI, the Department of the Treasury Treasury, and the Financial Crimes Enforcement Network FinCEN have released a joint Cybersecurity Advisory CSA, StopRansomware: MedusaLocker, to provide information on MedusaLocker ransomware. MedusaLocker actors target...

KubeEdge Denial of Service Vulnerability

KubeEdge is an open source edge computing framework built on Kubernetes and extends containerized application orchestration and device management to hosts on the end. A denial-of-service vulnerability exists in KubeEdge versions prior to 1.11.0, prior to 1.10.1, and prior to 1.9.3, which can be...

LDAP Account Manager Injection Vulnerability (CNVD-2022-53544)

LDAP Account Manager is a web front-end for managing entries e.g., users, groups, DHCP settings stored in the LDAP directory.An injection vulnerability exists in LDAP Account Manager LAM versions prior to 8.0, which stems from faulty access control and could be exploited by an attacker to pass th...

CVE-2021-25003

creationtimestamp| type| source ---|---|--- 2022-06-29 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6293 2022-12-08 09:11:43+00:00| published-proof-of-concept| https://t.me/poxek/2605 2022-12-08 11:09:59+00:00| published-proof-of-concept|...

Vulnerabilities & Threats that Matter 20 June – 26 June 2022

Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 413 14 4 121 19 33 For a detailed threat digest, download the pdf file here Summary The last week of June 2022 witnessed the discovery of 413 vulnerabilities out of which ...

VitalPBX Access Control Error Vulnerability

VitalPBX is an Asterisk-based unified communications PBX system. It supports deployment on both virtual or physical machines, as well as in cloud server environments. An Access Control Error vulnerability exists in VitalPBX versions prior to 3.2.1, which stems from a lack of access control in the...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-52267)

Google Android is a Linux-based open source operating system from the U.S. company Google Google. Google Android has an elevation of privilege vulnerability that can be exploited by attackers to cause local privilege escalation...

Log4Shell Vulnerability in VMware Leads to Data Exfiltration and Ransomware

We analyzed cases of a Log4Shell vulnerability being exploited in certain versions of the software VMware Horizon. Many of these attacks resulted in data being exfiltrated from the infected systems. However, we also found that some of the victims were infected with ransomware days after the data...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-52268)

Google Android is a Linux-based open source operating system from the U.S. company Google Google. Google Android has an elevation of privilege vulnerability that can be exploited by attackers to cause local privilege escalation...

CISA Adds Eight Known Exploited Vulnerabilities to Catalog  

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Secheron SEPCOS Control and Protection Relay Weak Password Vulnerability

Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.The Secheron SEPCOS Control and Protection Relay has a weak password...

Elcomplus LLC SmartICS Cross-Site Scripting Vulnerability

Elcomplus LLC SmartICS is a builder of top-level visualizations for industrial automation systems from Elcomplus LLC. A cross-site scripting vulnerability exists in Elcomplus LLC SmartICS. The vulnerability stems from a failure to neutralize user-controllable input and can be exploited by an...

Library Management System With QR Code 1.0 Shell Upload

Title: Library Management System with QR code AttendanceFile Upload RCE Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Date: 27.06.2022 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...