2023 Cybersecurity Industry Predictions

With 2022 rapidly coming to a close, this is the time of year where it makes sense to take a step back and look at the year in cybersecurity, and make a few critical predictions for what the industry could face in the year ahead. In order to give the security community some insight into where we’...

Cross-Origin Resource Sharing (CORS)

quarkus-vertx-http is vulnerable to an insecure cross-origin resource sharing CORS policy. The vulnerability exists because the XMLHttpRequest has no event listeners registered on the object returned by the XMLHttpRequest upload property, allowing an attacker to send malicious GET and POST reques...

WP Social Sharing <= 2.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to Settings » WP Social Sharing page of...

Google Chrome Security Update (stable-channel-update-for-desktop_17-2021-06) - Mac OS X

Google Chrome is prone to multiple after free vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

Google Chrome Security Update (stable-channel-update-for-desktop_17-2021-06) - Linux

Google Chrome is prone to multiple after free vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

Pywirt - Python Windows Incident Response Toolkit

With this application, it is aimed to accelerate the incident response processes by collecting information in windows operating systems via winrm. Features Information is collected in the following contents. IP Configuration Users Groups Tasks Services Task Scheduler Registry Control Active TCP &...

What the CISA Reporting Rule Means for Your IT Security Protocol

The new Cyber Incident Reporting for Critical Infrastructure Act of 2022 CIRCIA requires CISA to create rules regarding cyber incident reporting by critical infrastructure organizations. The RFI and hearings precede a Notice of Proposed Rulemaking NPRM that CISA must publish sooner than 24 months...

Enable Screen sharing for BYOD Chromebook devices using Citrix Cloud

Users who use bring your own device Chromebook require teams and the ability to screen share...

Google Chrome injection vulnerability

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in Google Chrome, which stems from insufficient untrusted input validation in CORS. An attacker could exploit this vulnerability to bypass security restrictions...

Wiz integrates with Amazon Security Lake to improve cloud security through cloud security data sharing

New integration enables customers to consolidate security logs, run investigations and analyze security metrics in their customer-owned data lake...

CVE-2022-41568

LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat...

Micro Focus Filr security vulnerabilities

Micro Focus Filr is an enterprise-grade file access and sharing solution from Micro Focus, a UK-based company. A security vulnerability exists in Micro Focus Filr versions prior to 4.3.1.1, which can be exploited by an attacker to enumerate valid users of the system...

iSharer and upRedSun File Sharing Wizard Buffer Overflow (CVE-2019-16724)

A buffer overflow vulnerability exists in iSharer and upRedSun File Sharing Wizard. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

GHSA-P768-R2M2-8VJR Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module

A Cross-site scripting XSS vulnerability in the Sharing module's user notification before 3.0.9 from Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafte...

Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module

A Cross-site scripting XSS vulnerability in the Sharing module's user notification before 3.0.9 from Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafte...

CVE-2022-42111

A Cross-site scripting XSS vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload...

PT-2022-26256

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.1 through 7.4.2 Liferay DXP versions 7.2 before fix pack 19 Liferay DXP versions 7.3 before update 4 Description A Cross-site scripting XSS vulnerability in the Sharing module's user notification allows remote...

CVE-2022-42111: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload...

Nextcloud has an unspecified vulnerability (CNVD-2022-77502)

A security vulnerability exists in Nextcloud Desktop Client, an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the fact that its desktop client could be tricked into opening/executing local files when clicking o...