Watch Out! Hackers Begin Exploiting Recent Zyxel Firewalls RCE Vulnerability

--- Image source: z3r00t The U.S. Cybersecurity and Infrastructure Security Agency on Monday added two security flaws, including the recently disclosed remote code execution bug affecting Zyxel firewalls, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation...

US Sentence Ukrainian to 4 Years for Brute-forcing and Selling Login Credentials

By Deeba Ahmed The 28-year-old Ukrainian national Glib Oleksandr Ivanov-Tolpintsev was arrested in Poland and extradited to the USA in 2020.… This is a post from HackRead.com Read the original post: US Sentence Ukrainian to 4 Years for Brute-forcing and Selling Login Credentials...

Microsoft Windows Print Spooler Components Elevation of Privilege Vulnerability (CNVD-2022-70056)

An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler Components, a print backend processor component of Microsoft Corporation USA. The vulnerability stems from an incorrect program call to a high-level native procedure. An attacker could exploit this vulnerability to...

Mattermost Playbooks Plugin Elevation of Privilege Vulnerability

Mattermost Plugins is a plugin from Mattermost USA that provides powerful feature extensions and tight integration with both server and web/desktop applications.An elevation of privilege vulnerability exists in Mattermost Playbooks Plugin version 1.25 and earlier, which stems from incorrectly...

Cisco Adaptive Security Appliances Software Buffer Overflow Vulnerability

Cisco Adaptive Security Appliances Software is a set of firewalls and network security platforms from the U.S. company Cisco Cisco. The platform provides highly secure access to data and network resources and other features. A buffer overflow vulnerability exists in the Cisco Adaptive Security...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2022-46307)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution enables the management of all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for those assets.IBM Maximo...

Oracle Database Server Input Validation Error Vulnerability (CNVD-2022-36952)

Oracle Database Server is a relational database management system from Oracle Corporation USA. The database management system provides data management, distributed processing, etc. An input validation error vulnerability exists in Oracle Database, which originates from an input validation error i...

ZOHO ManageEngine OpManager SQL Injection Vulnerability (CNVD-2022-70603)

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO USA. A SQL injection vulnerability exists in versions prior to ZOHO ManageEngine OpManager 125588 and 125603, which stems from a problem in the inventory reporting module. An attacker could use this vulnerability...

Microsoft Windows Digital Media Receiver Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Digital Media Receiver. The vulnerability stems from an incorrect programmatic call to an advanced local procedure. ...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-62512)

Microsoft Windows Print Spooler is a print backend processor component of Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler, which could be exploited by attackers to execute arbitrary code with elevated privileges...

Microsoft Windows Kerberos Remote Code Execution Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A remote code execution vulnerability exists in Microsoft Windows Kerberos. The vulnerability stems from failure to properly process input data and can be exploited by an attacker to...

Microsoft Windows Endpoint Configuration Manager Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Endpoint Configuration Manager. The vulnerability stems from an incorrect programmatic call to an advanced local...

Cisco SD-WAN Elevation of Privilege Vulnerability

Cisco SD-WAN is a highly secure cloud-scale architecture from Cisco USA that is open, programmable, and scalable. an elevation of privilege vulnerability exists in Cisco SD-WAN, which stems from an incorrect programmatic call to a high-level native procedure. An attacker could exploit the...

Microsoft Windows SMB Remote Code Execution Vulnerability (CNVD-2022-74596)

Microsoft Windows SMB Server is a network file sharing protocol from Microsoft Corporation USA. It allows applications on a computer to read and write files and request services from server programs on the computer network.A remote code execution vulnerability exists in Microsoft Windows SMB. An...

Microsoft Azure Site Recovery Information Disclosure Vulnerability (CNVD-2022-56588)

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation USA. Microsoft Azure Site Recovery has an information disclosure vulnerability, and no details of the vulnerability are available...

Microsoft Windows Telephony Serve Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Telephony Server. The vulnerability stems from an incorrect programmatic call to an advanced local procedure. An...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2023-02194)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel. An attacker can exploit this vulnerability to execute arbitrary code on the system...

sens-usa.com Cross Site Scripting vulnerability OBB-2512435

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at Future Summits in Antwerp, Belgium, on May 18, 2022. I’m speaking at IT-S Now 2022 in Vienna, Austria, on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn,...

Reporting of cyber incidents becomes law in the USA

On March 15th 2022, president Joe Biden and the US Government passed new legislation to strengthen the Department for Justice DOJ Cybersecurity and Infrastructure Security Agency CISA position by requiring the reporting of all cyber incidents or ransomware payments. The Cyber Incident Reporting f...