Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31650PUBLISHED: 2022-05-25In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651PUBLISHED: 2022-05-25In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
CVE-2022-29256PUBLISHED: 2022-05-25
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` e...
CVE-2022-26067PUBLISHED: 2022-05-25
An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this vulnera...
CVE-2022-26077PUBLISHED: 2022-05-25
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive information. An attacker can sniff networ...
User Rank: Moderator
12/17/2020 | 12:58:37 PM
Programmers are still not well trained in secure coding as the industry is more interested in quantity of code than security of code.
But the other problem is the actual elephant in the room: any computer or computer network that has internet access will forever be vulnerable and intrinsically insecure. Every networked device with an internet connection is either one or two user clicks away from compromise or just one determined Red Team's best efforts away from a successful breach. And we learn this lesson over & over again because we've become utterly dependent on an inherently insecure internet infrastructure.
This has become increasingly alarming because our personal information, intellectlual property, defense department data, financial information, and even the electronic door locks on our homes & businesses are all subject to remote attack and successful compromise. All the while, new internet connected products are released almost every day, and sales & marketing people run around selling "the cloud...the cloud". A cloud being a huge blindspot where almost anything could be happening that you won't see coming until the split second when it hits you.
So, we can make an educated guess and say with almost complete certainty that 2021 will report a new record number of CVE's. The beat goes on...