Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-25136PUBLISHED: 2023-02-03
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting thi...
CVE-2023-25139PUBLISHED: 2023-02-03
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of ...
CVE-2022-48074PUBLISHED: 2023-02-03An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
CVE-2023-25135PUBLISHED: 2023-02-03
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are...
CVE-2022-4634PUBLISHED: 2023-02-03All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.
User Rank: Moderator
9/15/2014 | 6:32:09 PM
Seriously though, the word "hopefully" calls attention to a potential risk factor that lies within secure coding practices and unpublished technical specifications. I researched by digging up everything I could find in the public domain and cross referencing that with my knowledge on the payment processing world from past experience working in multiple job functions at a payment processor.
Getting private details for publication from a highly secretive company would be difficult to say the least. I could have been sneaky by calling contacts, digging up dirt on Apple Pay's implementation and their security development lifecycle adherence track record, then publish a tell-all. But that would be a jerk move. Besides, I have a day job on top of writing articles as a contributing author.