What Are Shadow IDs, and How Are They Crucial in 2022?

Just before last Christmas, in a first-of-a-kind case, JPMorgan was fined $200M for employees using non-sanctioned applications for communicating about financial strategy. No mention of insider trading, naked shorting, or any malevolence. Just employees circumventing regulation using, well, Shado...

BlockWishList SQL Injection vulnerability

Impact An authenticated customer can perform SQL injection Patches Issue is fixed in 2.1.1...

GHSA-2JX3-5J9V-PRPP BlockWishList SQL Injection vulnerability

Impact An authenticated customer can perform SQL injection Patches Issue is fixed in 2.1.1...

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications application in the Oracle E-Business Suite system, which allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications application in the Oracle E-Business Suite exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized acces...

Avos ransomware group expands with new attack arsenal

By Flavio Costa, Chris Neal and Guilherme Venere. In a recent customer engagement, we observed a month-long AvosLocker campaign. The attackers utilized several different tools, including Cobalt Strike, Sliver and multiple commercial network scanners. The initial ingress point in this incident...

Malicious code in customer-stories-feed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 821bb90da51629b7a3ced3499eee822c96045e3b8dc9cad26684c1a2697b1826 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2288 Malicious code in customer-stories-feed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 821bb90da51629b7a3ced3499eee822c96045e3b8dc9cad26684c1a2697b1826 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How one Microsoft software engineer works to improve access management

There’s still a perception that the most successful computer scientists learn programming at a young age, study engineering at a top school, and then get a software development job right out of college. While that’s how many people enter the field, it’s not the only path. Microsoft Software...

How one Microsoft software engineer works to improve access management

There’s still a perception that the most successful computer scientists learn programming at a young age, study engineering at a top school, and then get a software development job right out of college. While that’s how many people enter the field, it’s not the only path. Microsoft Software...

CVE-2022-21503

Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to Oracle...

Security Bulletin: IBM Analytic Accelerator Framework for Communication Service Providers & IBM Customer and Network Analytics for Communications Service Providers and Datasets Impacted by Log4j Vulnerabilities ( CVE-2021-44832)

Summary Apache Log4j is used by as part of its logging infrastructure by IBM Analytic Accelerator Framework for Communication Service Providers AAF and IBM Customer and Network Analytics for Communications Service Providers and Datasets CNA. These products are vulnerable to CVE-2021-44832. The fi...

Security Bulletin: IBM Analytic Accelerator Framework for Communication Service Providers & IBM Customer and Network Analytics for Communications Service Providers and Datasets Impacted by Log4j Vulnerabilities (CVE-2021-45046, CVE-2021-45105)

Summary Apache Log4j is used by as part of its logging infrastructure by IBM Analytic Accelerator Framework for Communication Service Providers AAF and IBM Customer and Network Analytics for Communications Service Providers and Datasets CNA. These products are vulnerable to CVE-2021-45105 and...

Design/Logic Flaw

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

UBUNTU-CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

CVE-2022-32740

CVE-2022-32740 affects OTRS where a reply to a forwarded email article could unintentionally expose the email content to the ticket customer. Public sources in connected documents specify affected versions (OTRS 8.0.x up to 8.0.23 and 7.0.x up to 7.0.35) and describe a third party’s insufficient ...

CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

Stored XSS in Customer Company Description

Description The application inventree is vulnerable to Stored XSS in customer company description field. Proof of Concept Video PoC Link: https://drive.google.com/file/d/19l7W3MMeTdhQzroutdDBBIdIVLGhQtw1/view?usp=sharing...

Stored XSS in Customer Company Name

Description The application inventree is vulnerable to Stored XSS in customer company name field. Proof of Concept Video PoC Link: https://drive.google.com/file/d/11tKQzqKFobDEuqigsQYIdQhMnqSLIBsi/view?usp=sharing...

WordPress Download Manager 3.2.42 Cross Site Scripting Vulnerability

Description: Reflected Cross-Site Scripting Affected Plugin: Download Manager Plugin Slug: download-manager Plugin Developer: codename065 Affected Versions: = 3.2.42 CVE ID: CVE-2022-1985 CVSS Score: 6.1 Medium CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Researcher/s: Rafie Muhammad...