[SECURITY] Fedora 35 Update: httpie-3.1.0-1.fc35

HTTPie is a CLI HTTP utility built out of frustration with existing tools. The goal is to make CLI interaction with HTTP-based services as human-friendly as possible. HTTPie does so by providing an http command that allows for issuing arbitrary HTTP requests using a simple and natural syntax and...

Most ServiceNow Instances Misconfigured, Exposed

Nearly 70 percent of instances of the software-as-a-service SaaS platform ServiceNow Customers aren’t locking down access correctly, leading to 70 percent of ServiceNow implementations tested by AppOmni being potentially exposed to the public. ServiceNow is a $4.5 billion company whose software...

Interactive Medical Drawing of Human Body < 2.6 - Admin+ Stored XSS

The plugin does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Put the following payload in the Link settings of a body party and save the change: "alert/XSS-link/...

Ice Hrm Cross-Site Scripting Vulnerability (CNVD-2022-67480)

Ice Hrm is a human resource management system, and a cross-site scripting vulnerability exists in Ice Hrm version 30.0.0.OS. The vulnerability stems from the inability of the IceHRM website to effectively filter html tags in user input, which could be exploited by a logged-in attacker to steal...

The Art of Non-boring Cybersec Training–Podcast

Log4j, ransomware, cloud vulnerabilities, phishing: Cyber threats are manifold. They all pale, however, in comparison to the security black holes that walk around on two legs. Studies have shown that nearly all successful breaches stem from human error, be it failure to install security patches...

Possible Government Surveillance of the Otter.ai Transcription App

A reporter interviews a Uyghur human-rights advocate, and uses the Otter.ai transcription app. The next day, I received an odd note from Otter.ai, the automated transcription app that I had used to record the interview. It read: “Hey Phelim, to help us improve your Otter’s experience, what was th...

Cybercrooks Frame Targets by Planting Fabricated Digital Evidence

Threat actors are hijacking the devices of India’s human rights lawyers, activists and defenders, planting incriminating evidence to set them up for arrest, researchers warn. The actor, dubbed ModifiedElephant, has been at it for at least 10 years, and it’s still active. It’s been shafting target...

The vulnerability of Human Interface Devices in the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of Human Interface Devices in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2022-15505 · Sap · Sap Erp Hcm Portugal

Name of the Vulnerable Software and Affected Versions: SAP ERP HCM Portugal versions 600 through 608 Description: The issue concerns a report that reads payroll data of employees in a certain area without performing necessary authorization checks. This allows an attacker to access payroll...

SAP ERP HCM 安全漏洞

SAP ERP HCM is an enterprise human resource management solution from SAP, Germany. A security vulnerability exists in SAP ERP HCM that can be exploited by attackers to compromise vulnerable systems, including Business Objects, SAP CRM Web Channel, SAP CRM, SAP ERP, NetWeaver, ASE...

Welcome to the Burner Phone Olympics

China’s Winter Games are overshadowed by human rights problems and overreaching state surveillance...

Apple Fixes 2 Zero-Day Security Bugs, One Exploited in the Wild

Apple on Wednesday released 13 patches for serious security bugs in macOS and 10 for flaws in iOS/iPadOS. They include fixes for two zero-day bugs, one of which may have been exploited by attackers in the wild. The first zero-day CVE-2022-22587 is a memory-corruption issue that could be exploited...

SUSE SLES12: java-1_7_1-ibm / java-1_7_1-ibm-alsa / java-1_7_1-ibm-devel / etc (SUSE-SU-2022:0166-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0166-1 advisory. - Update to Java 7.1 Service Refresh 5 Fix Pack 0 - CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw...

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior 7.5.24 and prior 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).

...

CVE-2021-45222

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel...

CVE-2021-45222

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel...

CVE-2021-45222

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel...

Privilege escalation

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel...

PT-2022-12307 · Coins · Coins Construction Cloud

Name of the Vulnerable Software and Affected Versions: COINS Construction Cloud version 11.12 Description: An issue was discovered due to logical flaws in the human resources interface, making it vulnerable to privilege escalation by HR personnel. Recommendations: For COINS Construction Cloud...

Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-15479)

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Server is one of the database server components. An input validation error vulnerability exists in Oracle MySQL's MySQL Cluster product, which could be exploited by an attacker to access the physic...