Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31856PUBLISHED: 2022-07-05Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
CVE-2022-32310PUBLISHED: 2022-07-05An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php.
CVE-2022-32311PUBLISHED: 2022-07-05Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/view_stock.php.
CVE-2022-32413PUBLISHED: 2022-07-05An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-34972PUBLISHED: 2022-07-05So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_id , and subcate_value_id parameters at /index.php?route=extension/module/so_filter_shop_by/filter_data.
User Rank: Strategist
5/24/2017 | 10:46:02 AM
People. Don't. Care. Sure, we are supposed to *make* them care, but they don't. We help those on the fence to teeter over in favor of caution, but there will always be that population who is clearly on the other side of the fence, and not interested in taking those steps. They want to open every email, repost every Facebook "news" article, download whatever tools they feel they need to use, whenever they feel like it, and make their passwords easy to remember and quick to type.
Now, more than ever, I believe that technical controls are king, and security awareness is a borderline waste of time.
Borderlilne.