Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31017PUBLISHED: 2022-06-25
Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the serve...
CVE-2022-31016PUBLISHED: 2022-06-25
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated A...
CVE-2022-24893PUBLISHED: 2022-06-25
ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can resul...
CVE-2022-29168PUBLISHED: 2022-06-25
Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowi...
CVE-2019-25071PUBLISHED: 2022-06-25
** DISPUTED ** A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have...
User Rank: Ninja
2/18/2018 | 4:18:17 PM
It is the very innocuousness of the described data breach that is most troubling; as the attitudes and events that lead to it are pandemic in kind.
"Although the organization was closed, data inherited from 2009-2012 remained available on the server..." Where have you heard something like that before? If you've been listening - everywhere. You wouldn't even have to hear it to expect it, if you appreciate the way data is bought, sold, traded, stolen, abandoned, recycled, repurposed, relocated, disseminated, reconstituted....
There's another troubling element in the article: "On top of that, a recently discovered search engine makes it easier to look for data left on misconfigured S3 servers." Bad news for anyone who left S3 buckets unattended, and for those unknowing potential victims of poor data governance; but the news gets worse - as the idea of specialized search engines will become bad news for other discovered-vulnerable data storage schemes going forward.