CVE-2021-34568 WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service...

CVE-2022-3066

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an unauthorised user to create issues in a project...

CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...

CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...

CVE-2022-40713

An issue was discovered in NOKIA 1350OMS R14.2. Multiple Relative Path Traversal issues exist in different specific endpoints via the file parameter, allowing a remote authenticated attacker to read files on the filesystem arbitrarily...

CVE-2022-30573

The CVE-2022-30573 issue affects the ftlserver component of TIBCO FTL across Community (6.0.0–6.8.0), Developer (6.0.1–6.8.0), and Enterprise Editions (6.0.0–6.7.3 and 6.8.0). The vulnerability enables a low-privileged, network-access attacker to escalate privileges on the ftlserver, potentially ...

PT-2022-21838 · Samsung · Dex For Pc

Name of the Vulnerable Software and Affected Versions: DeX for PC versions prior to SMR Aug-2022 Release 1 Description: A vulnerability using PendingIntent in DeX for PC allows attackers to access files with system privilege. Recommendations: For DeX for PC versions prior to SMR Aug-2022 Release ...

IBM Security Verify Access Cross-Site Scripting Vulnerability (CNVD-2022-87651)

IBM Security Verify Access ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

PT-2022-3321 · Ws7200-10 · Ws7200-10

Name of the Vulnerable Software and Affected Versions: WS7200-10 version 11.0.2.13 Description: The issue is related to a password verification vulnerability. It allows attackers on the LAN to use brute force cracking to obtain passwords, potentially disclosing sensitive system information. The...

CVE-2022-31096 Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite h...

CVE-2022-21499

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7...

PT-2022-18626 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 12.5.3.2 in Android R11.0 Android versions prior to 13.0.1.1 in Android S12.0 Description: A vulnerability using PendingIntent in Accessibility allows an attacker to access files with system privilege. Recommendation...

Rockwell Automation ISaGRAF

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: ISaGRAF Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow arbitrary code execution. 3. TECHNICAL DETAILS 3.1...

CVE-2022-24758 Insertion of Sensitive Information into Log File affects Jupyter Notebook

The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by...

Remote Code Execution (RCE)

razorengine is vulnerable to remote code execution. The vulnerability exists because it does not sanitize the CAS code access security of an insecure sandboxed environment, allowing an attacker to execute maliciously crafted .NET code into the system...

Design/Logic Flaw

Out-of-bounds read in the firmware for some IntelR Processors may allow a privileged user to potentially enable an escalation of privilege via local access...

Accops HyWorks Windows Client Integer Overflow Vulnerability (CNVD-2021-100388)

Accops HyWorks is a suite of solutions consisting of software and hardware from Accops India. It is used to instantly and securely access enterprise applications remotely from anywhere, on any device and from any network. An integer overflow vulnerability exists in the Accops HyWorks Windows...

Security Bulletin: Access Security Control Vulnerability Affects IBM Sterling File Gateway (CVE-2021-20375)

Summary IBM Sterling File Gateway has addressed the security vulnerability. Vulnerability Details CVEID: CVE-2021-20375 DESCRIPTION: IBM Sterling File Gateway could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. CVSS Base score...

KnockOutlook - A Little Tool To Play With Outlook

"The best feeling is to win by knockout." - Nonito Donaire Overview KnockOutlook is a C project that interacts with Outlook's COM object in order to perform a number of operations useful in red team engagements. Command Line Usage metadata of every account search : search for the provided keyword...

Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...