Italiano
English
Secondo un articolo di Cnn.com le aziende americane cercano milioni di professionisti della cybersecurity garantendoli stipendi articoli (https://edition.cnn.com/2021/05/28/tech/cybersecurity-labor-shortage...
NOTIZIE & EVENTI
SERVIZI
|
Il servizio mostra una rappresentazione 3D del traffico di rete relativo ad attacchi ad una honeypot a Pisa. Inoltre,... |
Il servizio offre un sondaggio per la verifica della conformità di un’organizzazione al GDPR (General Data Protection... |
Il Thesaurus offre una rappresentazione della conoscenza di un insieme di termini relativi alla Cybersecurity,... |
Il servizio utilizza una raccolta di tweet provenienti da utenti appartenenti a Twitter i cui tweet utilizzano parole... |
ULTIMI CVE
| Published | Description | |
|---|---|---|
| CVE-2021-21357 |
23-03-2021 02:15:00 |
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1. |
| CVE-2021-21340 |
23-03-2021 02:15:00 |
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 . |
| CVE-2021-21355 |
23-03-2021 02:15:00 |
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in their direct or inherited domain model definitions and did not implement their own type converter. In case this scenario applies, _UploadedFileReferenceConverter_ accepts any file mime-type and persists files in the default location. In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1. |
| CVE-2021-21343 |
23-03-2021 00:15:00 |
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. |
| CVE-2021-21351 |
23-03-2021 00:15:00 |
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. |
Pages
ULTIMI EXPLOIT
| Date | Title | Platform | Author |
|---|---|---|---|
|
22-03-2021 |
OSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service Path | windows | Johnny Tech |
|
22-03-2021 |
SAPSetup Automatic Workstation Update Service 750 - 'NWSAPAutoWorkstationUpdateSvc' Unquoted Service Path | windows | Alan Mondragon |
|
22-03-2021 |
MyBB 1.8.25 - Chained Remote Command Execution | php | SivertPL |
|
22-03-2021 |
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm | hardware | LiquidWorm |
|
22-03-2021 |
Winpakpro 4.8 - 'ScheduleService' Unquoted Service Path | windows | Alan Mondragon |
Pages
CERT feeds
| Published | Title | URL |
|---|---|---|
| 30-07-2021 | Vulnerabilità della libreria libsndfile (AL01/210730/CSIRT-ITA) | CERT LINK |
| 28-07-2021 | Aggiornamenti Microsoft (AL01/210728/CSIRT-ITA) | CERT LINK |
| 28-07-2021 | Apple corregge vulnerabilità iOS, iPadOS e MacOS BigSur (AL02/210728/CSIRT-ITA) | CERT LINK |
| 26-07-2021 | La Settimana Cibernetica del 25 luglio 2021 | CERT LINK |
| 22-07-2021 | Aggiornamenti prodotti CISCO (AL02/210722/CSIRT-ITA) | CERT LINK |