Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-25878PUBLISHED: 2022-05-27
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.
This vulnerability can occur in multiple ways:
1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption ...
CVE-2021-27780PUBLISHED: 2022-05-27The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27781PUBLISHED: 2022-05-27The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2022-1897PUBLISHED: 2022-05-27Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-20666PUBLISHED: 2022-05-27
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
These vulnerabilities are due to insufficient va...
User Rank: Ninja
5/4/2015 | 7:31:23 AM
but on the other side of the balance are values desired by commercial interests: accessibility of customer data; ease of use; compatibility.
commercial interests have habitually written off the cost of hacking as "part of the cost of doing business". "Twenty cents per $100? --meh"
recently though the costs seem to be getting heavier as the hacking business has gone commercial on the DarkNet. Today hackers suck down customer cards, business bank balances, and business good name and reputation as well as customer good will in their hack attacks
at some point, when the write-off is no longer acceptable, the balance will need to be re-evaluated
security isn't something that can be managed selectively. you either implement it -- or just talk about it.