Oracle Financial Services Applications 输入验证错误漏洞

Oracle Financial Services Applications is a suite of financial services software from Oracle USA. The products include core banking, online banking and property management, etc. FLEXCUBE Universal Banking is one of the Internet and mobile banking solution components. An input validation error...

CVE-2022-21544: Undefined Security Weakness

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 12.1-12.4, 14.0-14.3 and 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTT...

CVE-2022-21585: Undefined Security Weakness

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications component: Infrastructure. The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bankin...

PT-2022-4693

Name of the Vulnerable Software and Affected Versions Oracle Banking Trade Finance version 14.5 Description The issue is due to insufficient input validation in the Infrastructure component. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Banking Trade Financ...

PT-2022-4694

Name of the Vulnerable Software and Affected Versions Oracle Banking Trade Finance version 14.5 Description The issue exists due to insufficient input validation in the Infrastructure component of Oracle Banking Trade Finance, allowing a remote attacker to gain unauthorized access to read, modify...

A Deep Dive Into the Residential Proxy Service ‘911’

The 911 service as it exists today. For the past seven years, an online service known as 911 has sold access to hundreds of thousands of Microsoft Windows computers daily, allowing customers to route their Internet traffic through PCs in virtually any country or city around the globe -- but...

North Korean Hackers Targeting Small and Midsize Businesses with H0lyGh0st Ransomware

An emerging threat cluster originating from North Korea has been linked to developing and using ransomware in cyberattacks targeting small businesses since September 2021. The group, which calls itself H0lyGh0st after the ransomware payload of the same name, is being tracked by the Microsoft Thre...

Top 5 Infrastructure as Code Security Challenges

Learn how to counteract the top five challenges of IaC and discover how these obstacles pose a threat to security and gain valuable insight in how to mitigate these risks...

Hybrid-Work Drives Hardware Security Strategies

Remote workforce, hybrid-cloud and Zero-Trust trends are pushing security teams to focus on hardware-assisted security strategies to better secure an evolving attack surface changed significantly by COVID. To address new challenges, hardware-assisted security is viewed as an effective and...

PT-2022-16346 · Pki-Core +4 · Pki-Core +4

Name of the Vulnerable Software and Affected Versions: pki-core affected versions not specified Description: A flaw was found in pki-core, allowing a user to obtain a certificate for another user identity when directory-based authentication is enabled. This issue enables an authenticated attacker...

pki-core 安全漏洞

pki-core is a library that provides an API for PKI operations. A security vulnerability exists in pki-core that stems from the use of the caServerKeygenDirUserCert profile, which allows a user to obtain the certificates of other UIDs by entering a name in the subject field...

Siemens CPC80 Firmware of SICAM A8000

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: CPC80 Firmware of SICAM A8000 Vulnerability: Missing Release of Resource after Effective Lifetime 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the...

Rethinking Vulnerability Management in a Heightened Threat Landscape

Mariano Nunez, CEO, Onapsis Repeated warnings from CISA and the Biden Administration on the Russian cyber threat over the last several months have heightened the state of alertness for U.S. agencies and businesses across industries, which are expecting ‘tit-for-tat’ cyberattacks from Russia in...

Rocket.Chat: Rocket.Chat Server RCE

Vulnerability description not provided...

Unpacking Cloud-Based Cryptocurrency Miners That Abuse GitHub Actions and Azure Virtual Machines

We investigate cloud-based cryptocurrency miners that leverage GitHub Actions and Azure virtual machines, including the cloud infrastructure and vulnerabilities that malicious actors exploit for easy monetary gain...

RLSA-2022:5498 Moderate: Satellite 6.11 Release

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fixes: libsolv: Heap-based buffer overflow in testcasere...

Latest Cyberattack Against Iran Part of Ongoing Campaign

Malware used in a crippling cyberattacks against an Iranian steel plants last week is connected to an attack that shut down the country’s rail system last year. In both cases, on malware strain was used to impact physical and critical infrastructure, according to a report from Check Point Researc...

Security Bulletin: A security vulnerability in log4j v1.2 affects IBM Cloud Pak for Multicloud Management Infrastructure Management Appliance

Summary A security vulnerability in log4j v1.2 affects IBM Cloud Pak for Multicloud Management Infrastructure Management Appliance. The fix removes Apache Log4j. Vulnerability Details CVEID:CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the...

TikTok Assures U.S. Lawmakers it's Working to Safeguard User Data From Chinese Staff

Following heightened worries that U.S. users' data had been accessed by TikTok engineers in China between September 2021 and January 2022, the company sought to assuage U.S. lawmakers that it's taking steps to "strengthen data security." The admission that some China-based employees can access...

PYSEC-2022-231

NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of...