Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35942PUBLISHED: 2022-08-12
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data ...
CVE-2022-35949PUBLISHED: 2022-08-12
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js con...
CVE-2022-35953PUBLISHED: 2022-08-12
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patche...
CVE-2022-35956PUBLISHED: 2022-08-12
This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgra...
CVE-2022-35943PUBLISHED: 2022-08-12
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter ...
Black Hat USA 2022 Attendee ReportBlack Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
User Rank: Ninja
10/30/2016 | 12:41:23 PM
Considering they telephoned me, and considering that the number they were calling from was not a telephone number known to me to be associated w/ my carrier, I refused. The huffy person on the other end of the line appeared put out.
I then called my insurance company on the number I knew to be correct to ask them about it. Unfortunately, it's such a big bureaucracy that I couldn't even get through to someone who could even tell me whether or not the call was legitimate for sure.
Because my insurance company was so bureaucratic and stupid, I wouldn't put it past them to have such stupid practices -- but it's also just as likely (at least) that it was a malfeasor's bit of social engineering. In any case, nothing bad happened to me because I refused to "verify" my information.
People calling you asking you to "verify" your information is the slightly more sophisticated social-engineering equivalent of someone calling you and after you say hello, the other person on the line immediately says, "Who's this?" YOU CALLED ME. >:P