665 matches found
CVE-2021-26360
CVE-2021-26360 describes a local-attack vulnerability in the AMD Secure Processor (ASP) where an attacker with local access can modify the security configuration of the SOC registers, potentially corrupting the ASP’s encrypted memory and enabling arbitrary code execution in the ASP environment. T...
CVE-2021-26360
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential corruption of AMD secure processor’s encrypted memory contents which may lead to arbitrary code execution in ASP...
Exploit for Authorization Bypass Through User-Controlled Key in Vmware Spring_Security
CVE-2022-31692 Demo Overview A simple Spring Boot applicat...
CISA Requests for Comment on Microsoft 365 Security Configuration Baselines
CISA has issued requests for comment RFCs on eight Microsoft 365 security configuration baselines as part of the Secure Cloud Business Application SCuBA project to secure federal civilian executive branch agencies’ FCEB cloud environments. The baselines: • Build on and integrate previous security...
Apache Isis webconsole module may directly query the database in prototype mode
When running in prototype mode, the h2 webconsole module accessible from the Prototype menu is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be...
CVE-2022-42467 h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.
When running in prototype mode, the h2 webconsole module accessible from the Prototype menu is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be...
New “Prestige” ransomware impacts organizations in Ukraine and Poland
The Microsoft Threat Intelligence Center MSTIC has identified evidence of a novel ransomware campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland utilizing a previously unidentified ransomware payload. We observed this new ransomware, which...
New “Prestige” ransomware impacts organizations in Ukraine and Poland
The Microsoft Threat Intelligence Center MSTIC has identified evidence of a novel ransomware campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland utilizing a previously unidentified ransomware payload. We observed this new ransomware, which...
The vulnerability of Mozilla VPN’s network software, related to security configuration errors, allows a hacker to bypass security restrictions.
The vulnerability of Mozilla VPN’s network software is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...
CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin
FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the...
Design/Logic Flaw
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...
The vulnerability of Microsoft Windows Defender operating systems, which allows a hacker to bypass security restrictions
The vulnerability of Microsoft Windows Defender operating systems is related to security configuration errors. Exploiting this vulnerability can allow attackers to circumvent security restrictions...
The vulnerability of the Crypto Pro downloader for the Windows operating system allows a hacker to bypass security restrictions and gain unauthorized access to the system.
The vulnerability of the Crypto Pro downloader for the Windows operating system is related to security configuration errors. Exploiting this vulnerability can allow a hacker to bypass security restrictions and gain unauthorized access to the system...
The vulnerability in the implementation of the SVG <use> element in the Mozilla Firefox browser allows a malicious actor to execute arbitrary JavaScript code.
The vulnerability of the SVG element implementation in Mozilla Firefox is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...
The vulnerability of the TeamPass password manager, related to security configuration errors, allows a hacker to delete any accessible file on the server.
The vulnerability of the TeamPass password manager is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to delete any accessible files on the server...
The vulnerability of the TeamPass password manager, related to security configuration errors, allows a hacker to access information from the database.
The vulnerability of the TeamPass password manager is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain information from the database...
The vulnerability of the TeamPass password manager, related to security configuration errors, allows a hacker to execute arbitrary PHP code.
The vulnerability of the TeamPass password manager is related to security configuration errors. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary PHP code...
The vulnerability of Microsoft Windows Defender, a security software for Windows operating systems, allows a hacker to bypass the Kerberos authentication process.
The vulnerability of Microsoft Windows Defender operating system is related to security configuration errors. Exploiting this vulnerability can allow a hacker to bypass the Kerberos authentication process...
The vulnerability of the New Horizon Data Systems loader for Windows operating systems allows a hacker to circumvent existing security restrictions.
The vulnerability of the New Horizon Data Systems driver for Windows operating systems is related to security configuration errors. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...
The vulnerability of Microsoft Excel editors, related to security configuration errors, allows attackers to circumvent existing security restrictions.
The vulnerability of Microsoft Excel editors is related to security configuration errors. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...