The Los Angeles Unified School District has lost control of a huge cache of sensitive data because its superintendent, Alberto M. Carvalho, refused to pay the ransom.
The post FAIL: Los Angeles School District Loses 500GB of PII appeared first on Secu…
Category: Vulnerabilities
Global Security News, Vulnerabilities
Critical Packagist Vulnerability Opened Door for PHP Supply Chain Attack
by Ionut Arghire •
Code security company SonarSource today published details on a severe vulnerability impacting Packagist, which could have been abused to mount supply chain attacks targeting the PHP community.
read more
Global Security News, Vulnerabilities
DHS Tells Federal Agencies to Improve Asset Visibility, Vulnerability Detection
by Ionut Arghire •
The Cybersecurity and Infrastructure Security Agency (CISA) this week published Binding Operational Directive 23-01 (BOD 23-01), which requires federal agencies to take the necessary steps to improve their asset visibility and vulnerability detection c…
Global Security News, Vulnerabilities
Critical Vulnerabilities Expose Parking Management System to Hacker Attacks
by Eduard Kovacs •
Nearly a dozen vulnerabilities have been found in a car parking management system made by Italian company Carlo Gavazzi, which makes electronic control components for building and industrial automation.
read more
Global Security News, Vulnerabilities
Mitigation for ProxyNotShell Exchange Vulnerabilities Easily Bypassed
by Eduard Kovacs •
A mitigation proposed by Microsoft and others for the new Exchange Server zero-day vulnerabilities named ProxyNotShell can be easily bypassed, researchers warn.
The security holes, officially tracked as CVE-2022-41040 and CVE-2022-41082, can allow an a…
Vulnerabilities
ZDI-22-1327: Apache Batik DefaultScriptSecurity Server-Side Request Forgery Remote Code Execution Vulnerability
by ZDI: Published Advisories •
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apache Batik. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
Vulnerabilities
ZDI-22-1328: Apache Batik DefaultExternalResourceSecurity Server-Side Request Forgery Information Disclosure Vulnerability
by ZDI: Published Advisories •
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apache Batik. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
Exploits, Security Bloggers, Security Vendor News, Vulnerabilities
THREAT ALERT: ProxyNotShell – Two Critical Vulnerabilities Affecting MS Exchange
by Cybereason Global SOC Team •
The Cybereason GSOC Managed Detection and Response (MDR) Team is investigating incidents that involve exploitation of the critical Microsoft Exchange vulnerabilities – CVE-2022–41040 and CVE-2022–41082, also known as ProxyNotShell. …
Europe, Featured Articles, Global Security News, North America, Vulnerabilities
OpenText Report Identifies Nastiest Malware for 2022
by Michael Vizard •
OpenText today published a Nastiest Malware of 2022 report that highlighted how ransomware attacks are evolving into triple threats. In addition to encrypting and stealing data, many attackers now include a distributed denial-of-service (DDoS) attack …
Global Security News, Vulnerabilities
LayerX Raises $7.5M Seed Funding to Tackle Secure Web Browsing
by Ryan Naraine •
Israeli startup LayerX has joined the list of companies scoring investor interest in the tricky enterprise browser market.
LayerX, based in Tel Aviv, came out of the shadows Monday with $7.5 million in seed funding and ambitious plans to build technolo…
Malware Indicators (IoCs), Vulnerabilities
Multiple Vulnerabilities Found In Canon Medical Vitrea View Software
by Abeerah Hashim •
Researchers have recently reported multiple vulnerabilities in the software for the Canon Medical Vitrea View…
Multiple Vulnerabilities Found In Canon Medical Vitrea View Software on Latest Hacking News | Cyber Security News, Hacking Tools and Pe…
Malware Indicators (IoCs), Vulnerabilities
Multiple Vulnerabilities Found In Canon Medical Vitrea View Software
by Abeerah Hashim •
Researchers have recently reported multiple vulnerabilities in the software for the Canon Medical Vitrea View…
Multiple Vulnerabilities Found In Canon Medical Vitrea View Software on Latest Hacking News | Cyber Security News, Hacking Tools and Pe…
Vulnerabilities
CVE-2022-42247
by National Vulnerability Database •
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.
Vulnerabilities
CVE-2022-41443
by National Vulnerability Database •
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
Vulnerabilities
CVE-2022-33882
by National Vulnerability Database •
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute …
Vulnerabilities
CVE-2022-42306 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange…
Vulnerabilities
CVE-2022-42307 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.
Vulnerabilities
CVE-2022-42308 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a path traversal in the pbx_exchange registration code.
Vulnerabilities
CVE-2022-42306
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange…
Vulnerabilities
CVE-2022-42307
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.
Vulnerabilities
CVE-2022-42308
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a path traversal in the pbx_exchange registration code.
Vulnerabilities
CVE-2022-42303
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Injection attack affecting the NBFSMCLIENT service by leveraging CVE-2022-42302.
Vulnerabilities
CVE-2022-42304
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting idm, nbars, and SLP manager code.
Vulnerabilities
CVE-2022-42305
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal attack through the DiscoveryService service.
Vulnerabilities
CVE-2022-42303 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Injection attack affecting the NBFSMCLIENT service by leveraging CVE-2022-42302.
Vulnerabilities
CVE-2022-42304 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting idm, nbars, and SLP manager code.
Vulnerabilities
CVE-2022-42305 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal attack through the DiscoveryService service.
Vulnerabilities
CVE-2022-42300
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting in a denial of service. (Note: the watchdog service will automatically restart the process.)
Vulnerabilities
CVE-2022-42301
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.
Vulnerabilities
CVE-2022-42302
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting the NBFSMCLIENT service.
Vulnerabilities
CVE-2022-42299
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service attack through the DiscoveryService service.
Vulnerabilities
CVE-2022-42299 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service attack through the DiscoveryService service.
Vulnerabilities
CVE-2022-42300 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting in a denial of service. (Note: the watchdog service will automatically restart the process.)
Vulnerabilities
CVE-2022-42301 (netbackup)
by National Vulnerability Database •
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.
Vulnerabilities
CVE-2022-40721
by National Vulnerability Database •
Arbitrary file upload vulnerability in php uploader
Vulnerabilities
CVE-2022-40764
by National Vulnerability Database •
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original d…
Vulnerabilities
CVE-2022-41301
by National Vulnerability Database •
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the curr…
Vulnerabilities
CVE-2022-33888
by National Vulnerability Database •
A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the c…
Vulnerabilities
CVE-2022-33889
by National Vulnerability Database •
A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated heap buffer. This vulnerability could lead to arbitrary code execution.
Vulnerabilities
CVE-2022-33890
by National Vulnerability Database •
A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the curr…