Posted by Egidio Romano on Jan 09
—————————————————————————–
Tiki Wiki CMS Groupware <= 24.0 (grid.php) PHP Object Injection
Vulnerability
—————————————————————————–
[-] Software Link:
[-] Affected Versions:
Version 24.0 and prior versions.
[-] Vulnerability Description:
The vulnerability is located in the /lib/sheet/grid.php script,
specifically into…
Posted by Egidio Romano on Jan 09
——————————————————————————–
Tiki Wiki CMS Groupware <= 24.0 (structlib.php) PHP Code Injection
Vulnerability
——————————————————————————–
[-] Software Link:
[-] Affected Versions:
Version 24.0 and prior versions.
[-] Vulnerability Description:
The vulnerability is located in the /lib/structures/structlib.php
script,…
Posted by Egidio Romano on Jan 09
——————————————————————————
Tiki Wiki CMS Groupware <= 25.0 Two Cross-Site Request Forgery
Vulnerabilities
——————————————————————————
[-] Software Link:
[-] Affected Versions:
Version 25.0 and prior versions.
[-] Vulnerabilities Description:
1) The /tiki-importer.php script does not implement any protection
against…
Mingwei Zhang discovered that the KVM implementation for AMD processors in
the Linux kernel did not properly handle cache coherency with Secure
Encrypted Virtualization (SEV). A local attacker could possibly use this to
cause a denial of service (host system crash). (CVE-2022-0171)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorrectly handled certain message
payloads in some situations. A remote attacker could possibly use this to
cause a denial of service or bypass firewall filtering. (CVE-2022-2663)
It was discovered that the Intel 740 frame buffer driver in the Linux
kernel contained a divide by zero vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2022-3061)
It was discovered that the sound subsystem in the Linux kernel contained a
race condition in some situations. A local attacker could use this to cause
a denial of service (system crash). (CVE-2022-3303)
Gwnaun Jung discovered that the SFB packet scheduling implementation in the
Linux kernel contained a use-after-free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2022-3586)
It was discovered that the NILFS2 file system implementation in the Linux
kernel did not properly deallocate memory in certain error conditions. An
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2022-3646)
Khalid Masum discovered that the NILFS2 file system implementation in the
Linux kernel did not properly handle certain error conditions, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service or possibly execute arbitrary code. (CVE-2022-3649)
Jann Horn discovered a race condition existed in the Linux kernel when
unmapping VMAs in certain situations, resulting in possible use-after-free
vulnerabilities. A local attacker could possibly use this to cause a denial
of service (system crash) or execute arbitrary code. (CVE-2022-39188)
Hyunwoo Kim discovered that an integer overflow vulnerability existed in
the PXA3xx graphics driver in the Linux kernel. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2022-39842)
It was discovered that a race condition existed in the EFI capsule loader
driver in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-40307)
Zheng Wang and Zhuorao Yang discovered that the RealTek RTL8712U wireless
driver in the Linux kernel contained a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-4095)
It was discovered that the USB monitoring (usbmon) component in the Linux
kernel did not properly set permissions on memory mapped in to user space
processes. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-43750)
The threat actors also deployed more aggressive techniques for mining CPU resources
These include infostealers, multi-layer encryption tools and dark web marketplace scripts
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Following the takedown of the Hydra Marketplace in 2022, 10 darknet markets rose to fill the void
Graham Cluley Security News is sponsored this week by the folks at Edgescan. Thanks to the great team there for their support! Edgescan simplifies Vulnerability Management (VM) by delivering a single full-stack SaaS solution integrated with world-class security professionals. Edgescan helps enterprise companies consolidate managing multiple point scanning tools for each layer of the attack … Continue reading “Does a hybrid model for vulnerability management make sense?”
As technology weaves itself into our lives in new and unexpected ways, some of it will get quite personal and close to home. That made itself clear at CES this year, which makes a strong case for your security.
The more things we connect, the more data we create. Data about ourselves that companies and others collect, share, and sell—where we are and what we’re doing, along with what we buy, watch, and search for. And today, we’re creating more of it and in more exacting detail.
We connect our homes with smart devices that create data about our comings and goings, and we connect ourselves with smart glasses and watches, rings, and things that track our health, our sleep, and wellness overall. Meanwhile, we have virtual reality and augmented reality hardware companies that want a place on your face with headsets and experiences that will take you into the metaverse.
Walking the floor of this year’s CES, you’ll see all these things, and plenty more. Yet central to it all is one thing—you. Specifically, your privacy and identity.
As technology evolves so rapidly and brings new ways of experiencing our world, it’s an exciting time. It’s also a somewhat uncertain time. What data will these devices create? Who’ll collect it? What will they do with it? And importantly, what can you do to protect yourself? Questions about your security are very much on our minds, and they’re on yours too. You’ve told us as much.
80% of you are concerned that a company could sell their data to another company.
81% of you are concerned that your identity could be stolen from an online transaction.
And unsurprisingly, protection is very much on your mind as well.
85% of you want to protect your identity online.
84% of you want to take back control of your data online.
And that’s where we come in. Just as the floor of CES showcases the evolution of life online, we’re evolving online protection as well. McAfee+ represents that next step—a product line that gives you a full slate of online protection that covers your privacy, identity, and devices so you can enjoy life online with confidence.
At the center of that online life is you, and our definition of online protection has become quite expansive as a result. We see how it can help you monitor your credit, your identity, and where your personal information crops up online. We see how it can prevent the wrong people from getting their hands on data and info too. And we see how our industry-first Protection Score can show you how safe you are—and offer guidance that can make you safer still. In all, we see it as an online companion, one that removes uncertainty and gives you a feeling of security. Because you truly are secure.
In all, protection today demands this comprehensive approach because we go about so much of our day online. McAfee+ reflects that reality. And with that, the various plans for McAfee+ include:
Personal Data Cleanup reveals which high-risk data brokers and people search sites are collecting and selling your personal information and requests the removal of the information, confirms completion, and conducts ongoing scans as data is always being collected.
Unlimited Secure VPN that automatically connects to public Wi-Fi to protect online privacy and safeguard personal data while online banking, shopping, or browsing.
$1M Identity Theft and Stolen Funds Coverage to reimburse lost funds or expenses in restoring the customer’s identity, including losses to 401(k) accounts.
Ransomware Coverage to reimburse up to $25,000 for losses and ransom fees.
Licensed Restoration Experts who can take necessary actions to repair identity and credit issues, including assistance to assist with identity fraud of a deceased family member.
Credit Monitoring and Alerts keeps an eye on changes to your credit score, report, and accounts with timely notifications and guidance so you can take action to tackle identity theft.
Credit Score and Report to help you stay on top of daily changes to your credit score and report, from a single location.
Credit Lock reduces the chance of becoming a victim of identity theft by allowing you to quickly lock and unlock your credit, which can help prevent unauthorized opening of accounts.
Security Freeze prevents unauthorized access to existing accounts or new ones being set up in your name with a credit, bank, or utility freeze.
Identity Monitoring for up to 60 unique pieces of personal information on the dark web with timely alerts up to 10 months sooner than competitive products.
And that list will only continue to grow. As the year takes shape, we’ll roll out yet more protections that will give you even more control of your privacy and identity. Particularly as you and your household rely on life online more and more.
As is true any year at CES, we see all manner of potential. New ways to make the day easier, more enjoyable, and more productive thanks to life online. Yet amidst it all, we see you. We see how you’ll use these new technologies, what the privacy, identity, and security implications are, and how we can protect you so you can benefit from these advances in technology, safely.
Like you, we’re excited for what’s next, and we’ll see to it that you can enjoy it—with protection that looks after you, your household, and your family.
The post The Case for Your Security at CES 2023 appeared first on McAfee Blog.
