A Simple Formula for Getting Your IT Security Budget Approved

Although there is a greater awareness of cybersecurity threats than ever before, it is becoming increasingly difficult for IT departments to get their security budgets approved. Security budgets seem to shrink each year and IT pros are constantly being asked to do more with less. Even so, the...

Security fix for the ALT Linux 10 package java-11-openjdk version 0:11.0.15.0.10-alt1_1jpp11

0:11.0.15.0.10-alt11jpp11 built July 14, 2022 Andrey Cherepanov in task 303498 June 29, 2022 Andrey Cherepanov - New version. - Security fixes + JDK-8270504, CVE-2022-21426: Better XPath expression handling + JDK-8275082, JDK-8278008, CVE-2022-21476: Update XML Security for Java to 2.3.0 +...

CVE-2022-33707

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device...

CVE-2022-33707

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device...

CVE-2022-33707

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device...

Input validation

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device...

SAMSUNG Mobile devices CID Manager 日志信息泄露漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices from the South Korean company Samsung SAMSUNG, including cell phones, tablets, and more. An information disclosure vulnerability exists in SAMSUNG Mobile devices CID Manager, which originates from exposing sensitive information during...

SAMSUNG Mobile devices isemtelephony 安全漏洞

Samsung isemtelephony is a telephony service for Samsung SAMSUNG mobile devices. samsung isemtelephony suffers from an information disclosure vulnerability that stems from incorrect authorization in isemtelephony, which could be exploited by an attacker to obtain a CID without permission...

CVE-2022-33707

CVE-2022-33707 affects Samsung Find My Mobile before version 7.2.24.12. The vulnerability stems from improper identifier creation logic, enabling an attacker to identify a target device. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, CVE records) with the same description. No ...

PT-2022-20296 · Unknown · Isemtelephony

Name of the Vulnerable Software and Affected Versions: isemtelephony versions prior to SMR Jul-2022 Release 1 Description: The issue is related to improper authorization, allowing an attacker to obtain CID without the necessary ACCESS FINE LOCATION permission. Recommendations: For versions prior ...

CVE-2022-2343 Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044...

Important: kernel

Issue Overview: A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege CAPSYSADMIN or CAPSYSRAWIO to create issues with confidentiality. CVE-2022-0494 An information...

Insider Threat: Employees indicted for stealing $88 million of license keys

Two insiders and an accomplice were indicted on Tuesday for multiple counts of fraud. According to documents unsealed by the Wester District of Oaklahoma, a grand jury charged Raymond Bradley Pearce aka Brad Pearce, a former employee of Avaya; Dusti O. Pearce, his wife; and Jason M. Hines aka Joe...

[SECURITY] Fedora 36 Update: golang-github-bobesa-domain-util-0-0.6.20200504git4033b5f.fc36

Handler for URL parts and identification of TLD and sub domains...

ASB-A-213457638

In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

GSD-2022-1003146 drm/omap: fix NULL but dereferenced coccicheck error

drm/omap: fix NULL but dereferenced coccicheck error This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

MELAG FTP Server User Enumeration Vulnerability

MELAG FTP Server is an FTP server from the German company MELAG. version 2.2.0.4 of MELAG FTP Server is vulnerable to a user enumeration vulnerability, which stems from the fact that the program presents different responses to users and non-users, and can be exploited by attackers to identify...

The vulnerability of the Inter-controller protocol implementation in Honeywell’s programmable logic controllers’ microprogramming software arises from the transmission of PIN codes, user names, and passwords as plain text. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Inter-controller protocol implementation for Honeywell programmable logic controllers involves the transmission of PIN codes, user names, and passwords as plain text. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to protect...

CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

API Security: Best Practices for a Changing Attack Surface

API usage is skyrocketing. According to the latest State of the API Report, API requests increased by 56% last year to a total of 855 million, and Google says the growth isn’t expected to slow any time soon. APIs – short for application programming interfaces – are a critical component of how...