Exec Order Could Force Software Vendors to Disclose …

ByPR 24
Enterprise Vulnerabilities
From DHS/US-CERT’s National Vulnerability Database

CVE-2020-19625
PUBLISHED: 2021-03-26

Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.

CVE-2020-19626
PUBLISHED: 2021-03-26

Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.

CVE-2020-25840
PUBLISHED: 2021-03-26

Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction.

CVE-2021-22506
PUBLISHED: 2021-03-26

Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

CVE-2021-3275
PUBLISHED: 2021-03-26

Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper valida…

Similar Posts

CISA doesn’t know how many US federal agencies use firewalls to fend off malicious traffic

CISA doesn’t know how many US federal agencies use firewalls to fend off malicious traffic

ByPR 24

Written by Tonya Riley Jun 21, 2021 | CYBERSCOOP The Department of Homeland Security’s top cybersecurity agency doesn’t know how many agencies are segmenting their networks from unwanted outside traffic, a basic security practice, according to a letter recently sent to the office of Sen. Ron Wyden (D-Ore.) by the agency. The agency provided the…

Hacker behind biggest ever cryptocurrency heist returns stolen funds

Hacker behind biggest ever cryptocurrency heist returns stolen funds

ByPR 24

The threat actor who hacked Poly Network’s cross-chain interoperability protocol yesterday to steal over $600 million worth of cryptocurrency assets is now returning the stolen funds. As the Chinese decentralized finance (DeFi) platform Poly Network shared two hours ago, the hacker has already returned almost $260 million worth of stolen cryptocurrency. In total, the attacker…

Facebook removes 100s of accounts for spreading iOS, Android malware

Facebook removes 100s of accounts for spreading iOS, Android malware

ByPR 24

The hackers were using malware campaigns to target iOS and Android devices used by Uyghurs living outside China including journalists. Facebook has removed accounts of hackers possibly backed by the Chinese government for targeting Uyghur community members living abroad. According to Facebook’s Head of Cyber Espionage Investigations, Mike Dvilyanski, and Head of Security Policy, Nathaniel…

Can the US Curb China’s Cyber Ambitions?

Can the US Curb China’s Cyber Ambitions?

ByPR 24

Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Governance & Risk Management Security Experts Weigh the Impact of White House’s Latest Cyber Moves Scott Ferguson (Ferguson_Writes) • July 20, 2021     Security experts are debating the impact of the Biden administration’s Monday condemnation of China for waging attacks on vulnerable Windows Exchange…

Federal agencies are failing to protect sensitive data, Senate report finds

Federal agencies are failing to protect sensitive data, Senate report finds

ByPR 24

Written by Tonya Riley Aug 3, 2021 | CYBERSCOOP Of eight federal agencies audited for their cybersecurity programs, only the Department of Homeland Security showed improvements in 2020, according to a report from the Senate Homeland Security and Governmental Affairs Committee. Released by the panel on Tuesday, the report expresses concerns about the state of…

SolarWinds Blames Intern for ‘solarwinds123’ Password Lapse

SolarWinds Blames Intern for ‘solarwinds123’ Password Lapse

ByPR 24

As cybersecurity researchers continue to piece together the sprawling SolarWinds supply chain attack, top executives of the Texas-based software services firm blamed an intern for a critical password lapse that went unnoticed for several years. The said password “solarwinds123” was originally believed to have been publicly accessible via a GitHub repository since June 17, 2018,…