Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35942PUBLISHED: 2022-08-12
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data ...
CVE-2022-35949PUBLISHED: 2022-08-12
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js con...
CVE-2022-35953PUBLISHED: 2022-08-12
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patche...
CVE-2022-35956PUBLISHED: 2022-08-12
This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgra...
CVE-2022-35943PUBLISHED: 2022-08-12
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter ...
User Rank: Ninja
5/31/2014 | 11:25:42 AM
If I can foster an email correspondence with anyone at the enterprise, as long as the email isn't aliased, I could possibly have your username. From there facebook could be used to pull personal data and maybe hone down the field of a password possibility if you create your own passwords. With this put into the specialized fields of a dictionary attack, it could take a lot less time to discover your password.
Now account lockouts are the next piece of security that would prevent intrusion. But if I am a hacker I do not want to go on site and try to bypass physical security as well. I would rather try and find an in remotely. Next step for me is to call the helpdesk for remote documentation. Some enterprises have multiple avenues for working remotely. Going back to my previous point about lockouts, the functionality of a remote client is to allow you to work from anywhere. Functionality is the main purpose here. Many don't have a lockout mechanism. So I can try to log in remotely as many times as I want, making my dictionary attack much more efficient. Once I have the credentials. I log in remotely during off hours, and because I don't need to change your password you may not be any the wiser.
This is all thanks to social engineering.