CVE-2022-31089 Invalid file request can crashe parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows a perpetrator to gain access to data reading or cause a partial service disruption.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data or cause partial service interruption...

The vulnerability of the Infrastructure component of the Oracle Banking Treasury Management software allows a perpetrator to gain access to protected information, modify file access rights, or cause partial service interruption.

The vulnerability of the Infrastructure component of the Oracle Banking Treasury Management software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information, modify file access rights, or...

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service disruption.

The vulnerability of Oracle Banking Trade Finance’s Infrastructure component is related to errors in the code. Exploiting this vulnerability allows a malicious actor to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service interruptions through...

The vulnerability of the Infrastructure component of the real-time payment processing software Oracle Banking Payments allows a attacker to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service disruption.

The vulnerability of the Infrastructure component of the real-time payment processing software in Oracle Banking Payments is related to the improper assignment of permissions for a critical resource. Exploiting this vulnerability allows an attacker, operating remotely, to create, delete, or modif...

Splunk Resource Permission Assignment Error Vulnerability

Splunk is a suite of data collection and analysis software from Splunk, Inc. The software is primarily used to collect, index, and analyze the data it generates, including data generated by all IT systems and infrastructure physical, virtual machines, and cloud.A resource privilege assignment err...

Dial 311 for… cybersecurity emergencies?

Members of the Cybersecurity Advisory Committee of CISA Cybersecurity and Infrastructure Security Agency have proposed an emergency cybersecurity call line for small and medium-sized businesses SMBs. Should the proposition be approved, SMBs would be able to call 311 in the event of a cybersecurit...

Discovery of 56 OT Device Flaws Blamed on Lackluster Security Culture

Researchers discovered 56 vulnerabilities affecting devices from 10 operational technology OT vendors, most of which they’ve attributed to inherent design flaws in equipment and a lax approach to security and risk management that have been plaguing the industry for decades, they said. The...

Network Pentesting Checklist

By Owais Sultan Network pentesting is a frequently used and successful method of recognizing security issues in a companys IT infrastructure.… This is a post from HackRead.com Read the original post: Network Pentesting Checklist...

Researchers Disclose 56 Vulnerabilities Impacting OT Devices from 10 Vendors

Nearly five dozen security vulnerabilities have been disclosed in devices from 10 operational technology OT vendors due to what researchers call are "insecure-by-design practices." Collectively dubbed OT:ICEFALL by Forescout, the 56 issues span as many as 26 device models from Bently Nevada,...

Examples of Cyber Warfare #TrendTalksBizSec

Cyber Warfare has been a topic of discussion for years but has reached a new level of prominence in this age of hyper-connected critical infrastructure. Our Trend Micro experts touch on this evolution, disinformation campaigns, and cyber mercenaries...

Phoenix Contact ProConOS and MULTIPROG

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ProConOS/ProConOS eCLR and MULTIPROG Vulnerability: Insufficient Verification of Data Authenticity CISA is aware of a public report, known as “OT:ICEFALL” that details...

Phoenix Contact Classic Line Industrial Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC 131 ETH, ILC 131 ETH/XC, ILC 151 ETH, ILC 151 ETH/XC, ILC 171 ETH 2TX, ILC 191 ETH 2TX, ILC 191 ME/AN, and AXC 1050 Vulnerability: Missing Authentication for Critical...

Client-side Magecart attacks still around, but more covert

This blog post was authored by Jérôme Segura We have seen and heard less buzz about Magecart during the past several months. While some marketing playbooks continue to rehash the same breaches of yesteryear, we have been wondering if some changes took place in the threat landscape. One thing we...

MAL-2022-3817 Malicious code in infrastructure_skypefeedback_tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3e45ece037df6f927c55b5079c950e4939cfdd1318f8908ee9979bb5f89bf0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6023 Malicious code in serverless-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bebbd005e7aca2a94388399022dc43f7cafb873c364c88ccefdd1d1d823f0134 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6629 Malicious code in traditional-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc15ec1e57cd2054d0571b163cd904eef13c3f7132a27202419a7c75c067d63a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in serverless-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bebbd005e7aca2a94388399022dc43f7cafb873c364c88ccefdd1d1d823f0134 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in httpinfrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34c25bae800f5d8e992b1fbda3daf30b45b483169d38d39cd5f87d0d3be3953c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-21503

Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to Oracle...