PT-2022-34199 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.212 Description: A data-race issue exists around netdev budget. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v2.6.13 and is fixed in Linux Kernel...

OnTrack 安全漏洞

OnTrack is a simple self-hosted budget application from the individual developer Isaac Noda. OnTrack version v3.4 suffers from a security vulnerability that stems from the use of a weak password policy that allows an attacker to potentially gain unauthorized access to the application through brut...

6 reasons MSPs need a patch management platform

Weve all heard the stories: Organizations getting breached like there's no tomorrow thanks to threat actors exploiting unpatched vulnerabilities. Likewise, weve also all heard the familiar refrain: Patch regularly! But for many businesses--including the Managed Service Providers MSPs that serve...

4 Cybersecurity Budget Management Tips

Learn how CISOs can strategically manage their cybersecurity budget to run more productive cybersecurity teams amid a skills shortage...

New subcontractor can be set for a SCConfirmed task without current subcontractor consent

Lines of code Vulnerability details Malicious builder/contractor can change the subcontractor for any task even if all the terms was agreed upon and work was started/finished, but the task wasn't set to completed yet, i.e. it's SCConfirmed, getAlertstaskID2 == true. This condition is not checked ...

It should not submit a project with no total budget. Requires at least one task with cost > 0

Lines of code Vulnerability details Impact When publishing a project, there is still possibility the project doesn't have any task or 0 budget. Proof of Concept According to contest guideline, there is an information says "Note that you cannot submit a project with no total budget. Therefore it...

On-Demand Webinar: New CISO Survey Reveals Top Challenges for Small Cyber Security Teams

The only threat more persistent to organizations than cyber criminals? The cyber security skills crisis. Nearly 60% of enterprises can't find the staff to protect their data and reputations! from new and emerging breeds of cyber-attacks, reports the Information Systems Security Association ISSA i...

A Simple Formula for Getting Your IT Security Budget Approved

Although there is a greater awareness of cybersecurity threats than ever before, it is becoming increasingly difficult for IT departments to get their security budgets approved. Security budgets seem to shrink each year and IT pros are constantly being asked to do more with less. Even so, the...

Rethinking Vulnerability Management in a Heightened Threat Landscape

Mariano Nunez, CEO, Onapsis Repeated warnings from CISA and the Biden Administration on the Russian cyber threat over the last several months have heightened the state of alertness for U.S. agencies and businesses across industries, which are expecting ‘tit-for-tat’ cyberattacks from Russia in...

How to Find Extra Cybersecurity Budget

Risk is up and budgets are down Organizational cybersecurity is a business issue, one could even say a finance issue, not just an IT issue. Gone are the days when cybersecurity was a luxury investment. Worldwide attacks are growing daily in frequency and complexity, regardless of the business siz...

Application Security in 2022: Where Are We Now?

It’s always a good thing to take a step back every once in a while to take the lay of the land. Like you, we are always working at a breakneck pace to help secure the web applications being built today and ready ourselves to secure the innovations of the future. When Forrester put out The State o...

4 Strategies to Help Your Cybersecurity Budget Work Harder

The digital economy is being disrupted by data. An estimated 79 zettabytes of data was created and consumed in 2021— a staggering amount that is reshaping how we do business. But as the volume and value of data increases, so does the motivation for hackers to steal it. As such, cybersecurity is a...

Comprehensive, Easy Cybersecurity for Lean IT Security Teams Starts with XDR

Breaches don't just happen to large enterprises. Threat actors are increasingly targeting small businesses. In fact, 43% of data breaches involved small to medium-sized businesses. But there is a glaring discrepancy. Larger businesses typically have the budget to keep their lights on if they are...

CVE-2022-30835

Wedding Management System v1.0 is vulnerable to SQL Injection. via /Wedding-Management/admin/budget.php?bookingid=...

Wedding Management System SQL注入漏洞

Wedding Management System v1.0 contains a SQL injection vulnerability in /Wedding-Management/admin/ budget.php?bookingid=The page lacks validation for external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

GHSA-9XMX-RJ7J-FV9Q Firefly III vulnerable to stored XSS

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the same acce...

Firefly III vulnerable to stored XSS

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the same acce...

CompoundHandler and other contracts call native payable.transfer

Title CompoundHandler topUp, EthPool doTransferOut and VaultReserve withdraw call native payable.transfer Impact Multiple operations are handled by using a payable.transfer call. transfer has a gas budget limit which is unsafe because gas costs can and may change and can fail when the user is a...

ETHVault, BkdEthCvx and VaultReserve use payable.transfer for inter-system transfers

Lines of code Vulnerability details Impact These contracts use payable.transfer for internal fund transfer, where the recipients are vaults, pools, strategies. This is generally unsafe as transfer has hard coded gas budget and can fail when the to is a smart contract. Such transactions will fail...

Threat Source newsletter (April 7, 2022) — More money for cybersecurity still doesn't solve the skills gap problem

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. U.S. President Joe Biden’s proposed budget would include an 11 percent increase in the federal government’s IT budget, including a total of $10.9 billion for cybersecurity. On the surface — this is all... This is only...