Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31017PUBLISHED: 2022-06-25
Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the serve...
CVE-2022-31016PUBLISHED: 2022-06-25
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated A...
CVE-2022-24893PUBLISHED: 2022-06-25
ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can resul...
CVE-2022-29168PUBLISHED: 2022-06-25
Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowi...
CVE-2019-25071PUBLISHED: 2022-06-25
** DISPUTED ** A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have...
User Rank: Strategist
3/15/2015 | 3:43:27 AM
I went to the Exploit Db, a site which has proven exploits available for penetration testing. I see a few dozen pages worth of exploits between what I would say is its inception, and the vast majority of which are confirmed. By most standards that's a large number of proven exploits. Granted, a properly patched system is not susceptible to most, if not all of those. Checks for patches would have to be done a very regular basis, though.
If I was running a Wordpress site, I would be huge on keeping that system patched (automatic updates if possible). I also remember reading a couple months back that a lot of the issues are with plugins. Me, I'd stay away from them. A quick scan of the Exploit DB list shows many are plugin-related exploits.
Security Focus is another good site. That'll should vulnerability information with sample programs and if patches are available. Very neat stuff.
Stay safe! Andy