Improper access control

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromi...

CVE-2021-24215

CVE-2021-24215 affects the Controlled Admin Access WordPress plugin (before 1.5.2). It is an improper access control vulnerability allowing unauthenticated attackers to access website customization and global CMS settings (e.g., /wp-admin/customization.php and /wp-admin/options.php), potentially ...

SonicWall Global Management System Command Execution Vulnerability

The SonicWall Global Management System GMS provides a holistic approach to managing the entire network security environment by business process and service level. A command execution vulnerability exists in SonicWall GMS version 9.3. An attacker could exploit the vulnerability to locally elevate...

SonicWall Global Management System 授权问题漏洞

The SonicWall Global Management System GMS provides a holistic approach to managing the entire network security environment by business process and service level. A command execution vulnerability exists in SonicWall GMS version 9.3. An attacker could exploit the vulnerability to locally elevate...

CVE-2020-13592

An exploitable SQL injection vulnerability exists in "globallists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either wi...

SAP Bugs Under Active Cyberattack

Active cyberattacks on known vulnerabilities in SAP systems could lead to full control of unsecured SAP applications, researchers are warning. Adversaries are carrying out a range of attacks, according to an alert from SAP and security firm Onapsis issued Tuesday – including theft of sensitive...

LinkedIn Spear-Phishing Campaign Targets Job Hunters

A threat group called Golden Chickens is delivering the fileless backdoor moreeggs through a spear-phishing campaign targeting professionals on LinkedIn with fake job offers, according to researchers at eSentire. The phishing emails try to trick a victim into clicking on a malicious .ZIP file by...

Qualcomm 芯片 资源管理错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc. and from time to time fabricated on the surface of semiconductor wafers. A security vulnerability exists in the Qualcomm GPS HLOS driver that...

OSV-2021-594 Global-buffer-overflow in read_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32791 Crash type: Global-buffer-overflow READ 1 Crash state: readcodingunit readcodingquadtree readcodingquadtree...

Financial Cyberthreats in 2020

2020 was challenging for everyone: companies, regulators, individuals. Due to the limitations imposed by the epidemiological situation, particular categories of users and businesses were increasingly targeted by cybercriminals. While we were adjusting to remote work and the rest of the new...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

PT-2021-14676 · Jenkins · Jenkins Owasp Dependency-Track Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OWASP Dependency-Track Plugin versions 3.1.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins. The issue arises...

OSV-2021-572 Global-buffer-overflow in mode_sense_page

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32538 Crash type: Global-buffer-overflow READ 4 Crash state: modesensepage scsidiskcheckmodeselect modeselectpages...

Threat landscape for industrial automation systems. Statistics for H2 2020

Figures Indicator | H1 2020 | H2 2020 | 2020 ---|---|---|--- Global percentage of attacked ICS computers | 32.6% | 33.42% | 38.55% Percentage of attacked ICS computers by region Northern Europe | 10.1% | 11.5% | 12.3% Western Europe | 15.1% | 14.8% | 17.6% Australia | 16.3% | 17.0% | 18.9% United...

Ransomware Attack Foils IoT Giant Sierra Wireless

A ransomware attack on leading internet-of-things IoT manufacturer Sierra Wireless this week ground its production activity to a halt and froze various other internal operations. The Canadian multinational manufacturer creates a broad array of communications equipment – from gateways to routers,...

Akamai Focused on "What's Next" Following New Traffic Milestone

Akamai hit a new milestone last week when web traffic delivered across our edge network peaked at 200 terabits per second Tbps. To be blunt - that's a whole lot of data traveling the world in a very short amount of time. We believe we can make a good case that it's more than the entire reported...

Women in Security Part 5: Meet Lavine Oluoch, Threat Analyst

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack In continued celebration of Women’s History Month, we are excited to bring you our next featured security expert as a part of our six-part Women in Security series. Throughout March, we are...

HID Global OMNIKEY 跨站请求伪造漏洞

HID Global OMNIKEY is a hardware device from HID Global, Inc. It is used to read cards. A security vulnerability exists in the HID OMNIKEY 5427 and OMNIKEY 5127 readers, which can be exploited by a remote attacker to upload a configuration file by convincing an authenticated user to visit a...