4770 matches found
Skeletons in the Closet: Security 101 Takes a Backseat to 0-days
Rarely a month goes by without the infosec industry being plagued by a new zero-day apocalypse. Most recently in December 2021, the world was swept by a series of vulnerabilities in Log4J – a popular logging system used by thousands of systems around the world. While writing this article, the...
PT-2022-19701 · Unknown · Bulletproofs
Name of the Vulnerable Software and Affected Versions: Bulletproofs affected versions not specified Description: The issue arises from the mishandling of Fiat-Shamir generation in the Bulletproofs 2017/1066 paper. Specifically, the hash computation fails to include all public values from the Zero...
Hackers Exploiting Recently Reported Windows Print Spooler Vulnerability in the Wild
A security flaw in the Windows Print Spooler component that was patched by Microsoft in February is being actively exploited in the wild, the U.S. Cybersecurity and Infrastructure Security Agency CISA has warned. To that end, the agency has added the shortcoming to its Known Exploited...
GHSA-32RP-Q37P-JG6W Insecure plugin handling in Mattermost
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...
CVE-2022-1384
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...
Design/Logic Flaw
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...
CVE-2022-1384
CVE-2022-1384 concerns Mattermost 6.4.x and earlier, where the system fails to properly validate the version of a plugin when installed from the Marketplace. The root cause is a deficient plugin-version check, which enables an authenticated and authorized user to install and potentially exploit a...
CVE-2022-1384
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...
No memory limit for dom0less domUs (XSA-383)
The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allows a domain to allocate memory beyond what an administrator originally configured. Note that Nessus has not tested for this issue...
QNAP QTS / QuTS hero Command Injection (QSA-21-05)
The version of QNAP QTS or QuTS hero on the remote host is affected by a command injection vulnerability. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. Note that Nessus has not tested for this issue but has instead relied only on the...
CISA Adds Nine Known Exploited Vulnerabilities to Catalog
CISA has added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly add...
CISA Adds 10 Known Exploited Vulnerabilities to Catalog
CISA has added 10 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...
Microsoft Windows Multiple Vulnerabilities (KB5012647)
This host is missing an important security update according to Microsoft KB5012647 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
Microsoft Windows Multiple Vulnerabilities (KB5012596)
This host is missing an important security update according to Microsoft KB5012596 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
Microsoft Windows Multiple Vulnerabilities (KB5012599)
This host is missing an important security update according to Microsoft KB5012599 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
Description of the security update for SharePoint Server Subscription Edition: April 12, 2022 (KB5002191)
None None...
April 12, 2022—KB5012639 (Security-only update)
None None...