788 matches found
2022 CWE Top 25 Most Dangerous Software Weaknesses
The Homeland Security Systems Engineering and Development Institute, sponsored by CISA and operated by MITRE, has released the 2022 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesses list. The list uses data from the National Vulnerability Database to compile the most...
The vulnerability of the BSAP/IP protocol implementation of the telemechanics controller ControlWave and the Bristol Babcock 33xx controller allows a perpetrator to increase their privileges.
The vulnerability of the BSAP/IP protocol implementation of the telemechanics controller ControlWave and the Bristol Babcock 33xx controller is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor to gain increase...
The vulnerability of the EpicMo protocol lies in its ability to exploit measurement-and-control controllers from the Experion LX, allowing attackers to cause service failures.
The vulnerability of the EpicMo protocol, which is implemented in measurement and control controllers of the Experion LX, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
Cyber Risk Retainers: Not Another Insurance Policy
The one-two punch of a cyberattack can be devastating. There is the breach and then the related mitigation costs. Implementing a comprehensive Incident Response IR gameplan into a worst-case-scenario should not be a post-breach scramble. And when that IR strategy includes insurance, it also must...
The vulnerability of the Windows Installer component on Windows operating systems, which allows a hacker to increase their privileges
The vulnerability of the Windows Installer component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the Windows Digital Media Receiver component in Windows operating systems allows attackers to exploit their privileges.
The vulnerability of the Windows Digital Media Receiver component in operating systems with Windows is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
F5 Networks BIG-IP : Diffie-Hellman key agreement protocol weaknesses (K83120834)
The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.4 / 17.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the K83120834 advisory. The Diffie-Hellman Key Agreement Protocol allows remote attackers from the client side to send arbitrary...
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Microsoft processes 24 trillion signals every 24 hours, and we have blocked billions of attacks in the last year alone. Microsoft Security tracks more than 35 unique ransomware families and 250 unique threat actors across observed nation-state, ransomware, and criminal activities. That depth of...
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Microsoft processes 24 trillion signals every 24 hours, and we have blocked billions of attacks in the last year alone. Microsoft Security tracks more than 35 unique ransomware families and 250 unique threat actors across observed nation-state, ransomware, and criminal activities. That depth of...
The vulnerability of the VMware Verify component in the Workspace ONE Access application management platform allows a perpetrator to increase their privileges.
The vulnerability of the VMware Verify component in the Workspace ONE Access application management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...
The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, allowing attackers to gain access to confidential data.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to improper access control when using GraphQL. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...
NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation
The maintainers of the NGINX web server project have issued mitigations to address security weaknesses in its Lightweight Directory Access Protocol LDAP Reference Implementation. "NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use...
The vulnerability of the application deployment automation tool in Kubernetes ArgoCD, related to access control deficiencies, allows a perpetrator to increase their privileges.
The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
CVE-2021-27501
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities...
Bypassing Two-Factor Authentication
These techniques are not new, but theyre increasingly popular: …some forms of MFA are stronger than others, and recent events show that these weaker forms arent much of a hurdle for some hackers to clear. In the past few months, suspected script kiddies like the Lapsus$ data extortion gang and...
The vulnerability of Xen hypervisors is related to deficiencies in authentication procedures. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of Xen hypervisors is related to deficiencies in the authentication process. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...
The vulnerability of the Suricata intrusion detection and prevention system, due to deficiencies in access control, allows an intruder to trigger a service failure.
The vulnerability of the Suricata intrusion detection and prevention system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service interruptions...
GE General Electric Renewable Energy MDS Radios 加密问题漏洞
GE General Electric Renewable Energy MDS Radios are a family of industrial wireless solutions from General Electric GE. GE General Electric Renewable Energy's MDS iNET/iNET II/SD/TD220/TD220MAX Radios are vulnerable to an encryption issue that stems from weaknesses in the wireless security softwa...
Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows attackers to gain privileged access
Vulnerability of the MySQL Cluster component: General database management system vulnerabilities in MySQL Cluster exist due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain privileged access remotely...
The vulnerability of the software package for handwritten input in the Microsoft Windows Inking COM operating system allows a hacker to circumvent security restrictions and gain increased privileges.
The vulnerability of the software package for handwritten input in the Inking COM operating system of Microsoft Windows is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to bypass security restrictions and enhance their privileges...