Payara Platform Path Traversal

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Path Traversal Vulnerability product: Payara Platform vulnerable version: Enterprise: 5.45.0 Community: 6.2022.1, 5.2022.4, 4.1.2.191.38 fixed version: Enterprise: 5.45.0...

The vulnerability of the HTTP(S) control module for operating systems HiOS with Belden Hirschmann network switches of the RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, and RED series, as well as the operating system HiSecOS with Belden Hirschmann network switches of the EAGLE20/30 series, allows a perpetrator to cause service interruptions.

The vulnerability of the HTTPS control module for operating systems HiOS and network switches from Belden Hirschmann, models RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, as well as the operating system HiSecOS for network switches from Belden Hirschmann, model EAGLE20/30, is related to th...

PT-2022-5711 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.0.8 Description: The issue is related to a buffer overflow error in the httpd daemon of the NETGEAR R7000P router's firmware. This can be exploited by a remote attacker to execute arbitrary code through the wan dns1...

PT-2022-5718 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P versions V1.3.0.8 through V1.3.1.64 Description: The issue is related to a buffer overflow error via parameters stamode dns1 pri and stamode dns1 sec. This can allow a remote attacker to execute arbitrary code through these...

CVE-2022-21630

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

CVE-2022-21630

CVE-2022-21630 affects Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC); affected versions are 9.2.6.4 and earlier. An unauthenticated attacker with network access via HTTP can compromise JD Edwards EnterpriseOne Tools, with successful exploits reportedly requiring user interaction. The vu...

CVE-2022-21631

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Design Tools SEC. Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

Omnicell Healthcare Company Confirms Ransomware Incident

In a US SEC Securities and Exchange Commission 8-K filing, Omnicell, the healthcare technology provider, revealed that some of its products, services, and internal systems were affected by ransomware. Upon detecting the incident, the medication management systems provider took immediate action to...

Kim Kardashian gets huge fine for crypto ad

The Securities and Exchange Commission SEC announced in a recent press release that it's charging celebrity influencer Kim Kardashian for violating Section 17b of the Securities Act of 1933, or the anti-touting provision. Kardashian was paid to promote EthereumMax or EMAX, a crypto asset security...

Morgan Stanley's years-long "extensive failure" to protect customer data ends in huge fine

On Tuesday, the Securities and Exchange Commission SEC charged financial company Morgan Stanley a $35M fine for "the firm's extensive failures, over five years, to protect the personal identifying information, or PII, of approximately 15 million customers. The company agreed to settle the penalty...

Mageia: Security Advisory (MGASA-2022-0336)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GSD-2022-1005876 crypto: hisilicon/sec - don't sleep when in softirq

crypto: hisilicon/sec - don't sleep when in softirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.137 by commit...

GSD-2022-1005627 crypto: hisilicon/sec - don't sleep when in softirq

crypto: hisilicon/sec - don't sleep when in softirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

GSD-2022-1005287 crypto: hisilicon/sec - don't sleep when in softirq

crypto: hisilicon/sec - don't sleep when in softirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

PT-2022-33545 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to a problem in the crypto: hisilicon/sec component where the system does not sleep when in softirq. The actual impact and attack plausibility have not yet been proven...

Incident Reporting Regulations Summary and Chart

A growing number of regulations require organizations to report significant cybersecurity incidents. We've created a chart that summarizes 11 proposed and current cyber incident reporting regulations and breaks down their common elements, such as who must report, what cyber incidents must be...

Mudge Files Whistleblower Complaint against Twitter

Peiter Zatko, aka Mudge, has filed a whistleblower complaint with the SEC against Twitter, claiming that they violated an eleven-year-old FTC settlement by having lousy security. And he should know; he was Twitters chief security officer until he was fired in January. The Washington Post has the...

Avoiding Smash and Grab Under the SEC’s Proposed Cyber Rule

The SEC recently proposed a regulation to require all public companies to report cybersecurity incidents within four days of determining that the incident is material. While Rapid7 generally supports the proposed rule, we are concerned that the rule requires companies to publicly disclose a cyber...

CVE-2022-33727

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33727

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...