Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-29376PUBLISHED: 2022-05-23Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute arbitrary code via overwriting binaries located in the directory.
CVE-2022-30015PUBLISHED: 2022-05-23In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss.
CVE-2022-28999PUBLISHED: 2022-05-23Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe.
CVE-2022-29002PUBLISHED: 2022-05-23A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
CVE-2022-31489PUBLISHED: 2022-05-23Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.
User Rank: Ninja
6/29/2019 | 8:23:41 AM
Interesting, I have worked a few ICS companies and what I have found is the following:
For example, a friend of mine in Washington, DC (Citrix Systems Integrator and Designer) worked with a utility company where he was the manager and designer of a VDI environment, the system was running (during that time) the latest version of Cisco Switches (Nexus), Cisco UCS, NetApp with high-speed connections bursting from 10G/sec to 80G/sec (numerous fibre connections from DC, Delaware to ATL). They were acquired by a large power company, the larger power company wanted to deploy their software versions (because they were unfamilar with the Citrix VDI solution currently running) on their hardware (remove existing). The company went from 99.99% uptime to 44.60% uptime after they deployed their solution (this was for the utility helpdesk). There was a buy out, people complained but they were bought out or let go. This is a prime example of individuals not willing to listen or absorb the best aspects of the company, we see it all the time in the IT business, it had nothing to do with money, it was more about control.
In certain cases, money may have been an issue but the number one issue was "fear" or unwillingness to accept that a group may be more knowledge in an area of IT. The mentality for years is based on "if it's not broke, don't fix it". Well that is no longer a valid adage for performance and security. I do think it is a mentality but with proper planning, work extensively with the vendor, setup a small lab, schedule meetings, adequately train internal staff and test patch to identify the affects; the organization can reduce their outage concerns while minimizing costs.
Todd