1345 matches found
Weak secrethash can be brute-forced
Description The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities 1.099.511.627.776 . The SHA1 of the secret can be obtained via a captcha string and...
7 Suspected Members of LAPSUS$ Hacker Gang, Aged 16 to 21, Arrested in U.K.
The City of London Police has arrested seven teenagers between the ages of 16 and 21 for their alleged connections to the prolific LAPSUS$ extortion gang that's linked to a recent burst of attacks targeting NVIDIA, Samsung, Ubisoft, LG, Microsoft, and Okta. "The City of London Police has been...
Cross site scripting
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution...
PT-2022-3854 · Totolink · Totolink A3100R +5
Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 TOTOLINK A810R version 4.1.2cu.5182 B20201026 TOTOLINK A830R version 5.9c.4729 B20191112 TOTOLINK A3000RU version 5.9c.5185 B20201128 TOTOLINK A3100R version 4.1.2cu.5050 B20200504 TOTOLINK A950RG...
Cross site scripting
The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
GHSA-952P-FQCP-G8PC HTML injection possibility in voucher code form in Shopware
Impact HTML injection possibility in voucher code form Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...
GHSA-W267-M9C4-8555 Shopware user session is not logged out if the password is reset via password recovery
Impact User session is not logged out if the password is reset via password recovery Patches Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview...
CVE-2022-24744
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...
Default credentials
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...
CVE-2022-24744 Insufficient Session Expiration in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...
Meta blocks Russia-Ukraine disinformation campaigns on Facebook, Instagram
Meta says it has detected and removed two disinformation campaigns regarding the current Russia-Ukraine war. These campaigns, it says, were run by groups in Russia and Ukraine to target Ukraine users. In the post, Nathaniel Gleicher, Metas head of security policy, and David Agranovich, Metas...
Cyberattackers Leverage DocuSign to Steal Microsoft Outlook Logins
A sophisticated phishing campaign directed at a “major, publicly traded integrated payments solution company located in North America” made use of DocuSign and a compromised third party’s email domain to skate past email security measures, researchers said. The campaign spread seemingly innocuous...
Talisman - By Hooking Into The Pre-Push Hook Provided By Git, Talisman Validates The Outgoing Changeset For Things That Look Suspicious
A tool to detect and prevent secrets from getting checked in What is Talisman? Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer's workstation. It validates the outgoing changeset for things that look...
PT-2022-7482 · Linux +6 · Linux Kernel +6
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc3+ Description: The vulnerability is related to a double free race condition in the cifs component of the Linux kernel. When cifs get root fails during cifs smb3 do mount, the kernel calls deactivate...
The vulnerability of the Windows GDI+ component in Windows operating systems allows attackers to disclose sensitive information that is protected by security measures.
The vulnerability of the Windows GDI+ component in Windows operating systems is related to deficiencies in the system’s controlled areas. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...
A worrying Etsy listing reveals the stalking potential of Apple’s AirTags
In April of 2021, Apple introduced AirTags to the world, making the small tracking devices—similar to a Tile— available for purchase at the end of that month. The circular, coin-like product is designed to be attached to or placed in objects that are commonly lost, such as keychains, wallets,...
4 Essential Facets of Brand Protection
By Owais Sultan Brand protection is a process of striving to prevent copycats, counterfeiters, and other bad actors from violating your… This is a post from HackRead.com Read the original post: 4 Essential Facets of Brand Protection...
Cyber-Spike: Orgs Suffer 925 Attacks per Week, an All-Time High
2021 dragged itself to a close under a Log4Shell-induced blitzkrieg. With millions of Log4j-targeted attacks clocking in per hour since the flaw’s discovery last month, there’s been a record-breaking peak of 925 cyberattacks a week per organization, globally. The number comes out of a Monday repo...
Thieves Using AirTags to “Follow” Cars
From Ontario and not surprising: Since September 2021, officers have investigated five incidents where suspects have placed small tracking devices on high-end vehicles so they can later locate and steal them. Brand name "air tags" are placed in out-of-sight areas of the target vehicles when they...