2902 matches found
Clouding the issue: what cloud threats lie in wait in 2022?
As more services move ever cloud-wards, so too do thoughts by attackers as to how best exploit them. With all that juicy data sitting on someone else’s servers, it’s essential that they run a tight ship. You’re offloading some of your responsibility onto a third party, and sometimes things can go...
Why Enterprise Threat Mitigation Requires Automated, Single-Purpose Tools
As much as threat mitigation is to a degree a specialist task involving cybersecurity experts, the day to day of threat mitigation often still comes down to systems administrators. For these sysadmins it's not an easy task, however. In enterprise IT, sysadmins teams have a wide remit but limited...
XML External Entity (XXE)
...
Malware Analyst – Job Description and How to Become
Introduction Malware investigation is the review or cycle of deciding the usefulness and possible effect of a given malware like an infection, worm, trojan, rootkit, or secondary passage. Malware or malignant programming is any PC programming planned to hurt the host working framework or to take...
CVE-2022-21824
Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...
OpSec. Hunting wireless access points
Continuing my series on OSINT techniques you can use for reviewing your own corporate OpSec, one of the most common services available in a modern corporate office is of course wireless. How do we go about finding wireless access points and what can they tell us? Finding wireless We have spoken...
Improper Access Control in liukuo362573/yishaadmin
Description https://www.github.com/liukuo362573/yishaadmin has an endpoint "/admin/File/UploadFile" that allows uploading files without authentication. Root-cause Server doesn't check user's permission when attacker access the endpoint. After that, server will directly call UploadFile function wi...
PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed depending on your rules regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list EDL i...
CVE-2022-21351 vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2022-21336 vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2022-21307 vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2022-21317 vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2022-21284 vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2022-21304 vulnerabilities
Vulnerabilities for packages: mysql...
Coming Soon: New Security Update Guide Notification System
Sharing information through the Security Update Guide is an important part of our ongoing effort to help customers manage security risks and keep systems protected. Based on your feedback we have been working to make signing up for and receiving Security Update Guide notifications easier. We are...
Codex Exposed: Exploring the Capabilities and Risks of OpenAI’s Code Generator
The first of a series of blog posts examines the security risks of Codex, a code generator powered by the GPT-3 engine...
Detecting Evasive Malware on IoT Devices Using Electromagnetic Emanations
Cybersecurity researchers have proposed a novel approach that harnesses electromagnetic field emanations from the Internet of Things IoT devices as a side-channel to glean precise knowledge about the different kinds of malware targeting the embedded systems, even in scenarios where obfuscation...
Inclusion of Sensitive Information in Source Code in pimcore/demo
Description API Keys is hard coded in the application source code. The use of a hard-coded API Key has many negative implications. Proof of Concept "security" = "method" = "datahubapikey", "apikey" = "6332aa5e6d3d6c0be31da2a8b3442113", "skipPermissionCheck" = FALSE...
CVE-2021-43528
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird...
GSD-2021-1002273 usb: musb: tusb6010: check return value after calling platform_get_resource()
usb: musb: tusb6010: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...