Device Security, Vulnerability management
SC StaffOctober 31, 2022
Juniper Networks devices are being affected with galore high-severity vulnerabilities involving the Junos OS, The Hacker News reports. Some of the flaws including a distant pre-authenticated PHP archive record deserialization bug wrong Junos OS's J-Web component, tracked arsenic CVE-2022-22241, could beryllium leveraged to facilitate distant codification execution, according to a study from Octagon Networks. "This vulnerability tin beryllium exploited by an unauthenticated distant attacker to get distant phar files deserialized, starring to arbitrary record write, which leads to a distant codification execution (RCE)," said Octagon Networks researcher Paulos Yibelo. Malicious actors could besides exploit a pre-authenticated reflected mistake leafage XSS bug, tracked arsenic CVE-2022-22242, to exfiltrate Junos OS admin sessions, portion XPATH injection flaws, tracked arsenic CVE-2022-22243 and CVE-2022-22244, could beryllium utilized for Junos OS admin league theft and manipulation. Other flaws identified see a way traversal vulnerability, tracked arsenic CVE-2022-22245, and a section record inclusion bug, tracked arsenic CVE-2022-22246. Juniper Networks has already addressed the flaws successful newer releases of the Junos OS.
When Worlds Collide: Dealing with Converged Identities and Devices – Gary Orenstein – ESW #294
October 27, 2022
For galore companies, the pretenses of separation betwixt enactment and location person wholly disappeared. This has immense information implications for organizations, but creates immoderate opportunities arsenic well. How should organizations and vendors attack the caller paradigm of shared devices and identities?
Widespread ConnectWise RCE vulnerability addressed
SC StaffOctober 31, 2022
ConnectWise has patched a captious flaw impacting the ConnectWise Recover and R1Soft Server Backup Manager unafraid backup solutions, which could beryllium exploited to facilitate distant codification execution oregon unauthorized information access, according to BleepingComputer.
More than 200 banking, crypto apps targeted by Android dropper apps
SC StaffOctober 31, 2022
ThreatFabric researchers discovered that 231 banking and cryptocurrency wallet apps from U.S., Australian, French, Dutch, Spanish, German, Polish, Italian, Austrian, and U.K. fiscal entities are being targeted by 5 malicious dropper Android apps that person been downloaded much than 130,000 times successful the Google Play Store, reports The Hacker News.
/cdn.vox-cdn.com/uploads/chorus_asset/file/24020034/226270_iPHONE_14_PHO_akrales_0595.jpg)
English (US)