Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-30333PUBLISHED: 2022-05-09RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVE-2022-23066PUBLISHED: 2022-05-09
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to tra...
CVE-2022-28463PUBLISHED: 2022-05-08ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CVE-2022-28470PUBLISHED: 2022-05-08marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
CVE-2022-1620PUBLISHED: 2022-05-08NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.
User Rank: Strategist
10/12/2017 | 9:13:35 AM
HR generalists and recruiters are mostly not competent (not equipped, to be nice) to recruit security professionals.
Another major problem is that positions are not properly and consistently categorized. I can see two positions with near IDENTICAL veribiage, and when I inquire on compensation, there can be a $10k, $20k, $30k or more difference. The detail here is that HR doesn't have context to know if they are filling a firewall admin or security/SOC analyst v filling an ISSO or Security Engineer or Security Architect (or CISO). When they realize they really want an ISSO or Security Engineer, they are going to have to up their game $25k or so.
Part of this stems from Infosec not defining the differences between technical security (e.g. firewall) and infosec management (e.g. ISSO, CISO). DoD has a policy defining these (by associated certifications), but I dont think that is widely known.
My attempt to train the recuiter-seekers is to re-work my resume to list the Roles I fulfill, Qualifications and certifications, Goals and Skills. The lastly, Experience/Job list. Word search only will get then so far; they are going to have to read my story before they get to review former employers. You would be amazed how many interviews are not interviews - only review of former employment. Ridiculous waste of my time. Listen to what I am telling you (I AM the Expert, after all).
Oh, and how did that HR miss the clues of "'didn't look into your eyes'" as a possible indicator of extreme competence? Just read "Girl with the Dragon Tattoo" to gain some insight.
I can only hope this gets cross-posted to some HR/Recruiting sites.....