Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31856PUBLISHED: 2022-07-05Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
CVE-2022-32310PUBLISHED: 2022-07-05An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php.
CVE-2022-32311PUBLISHED: 2022-07-05Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/view_stock.php.
CVE-2022-32413PUBLISHED: 2022-07-05An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-34972PUBLISHED: 2022-07-05So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_id , and subcate_value_id parameters at /index.php?route=extension/module/so_filter_shop_by/filter_data.
User Rank: Moderator
12/17/2020 | 12:58:37 PM
Programmers are still not well trained in secure coding as the industry is more interested in quantity of code than security of code.
But the other problem is the actual elephant in the room: any computer or computer network that has internet access will forever be vulnerable and intrinsically insecure. Every networked device with an internet connection is either one or two user clicks away from compromise or just one determined Red Team's best efforts away from a successful breach. And we learn this lesson over & over again because we've become utterly dependent on an inherently insecure internet infrastructure.
This has become increasingly alarming because our personal information, intellectlual property, defense department data, financial information, and even the electronic door locks on our homes & businesses are all subject to remote attack and successful compromise. All the while, new internet connected products are released almost every day, and sales & marketing people run around selling "the cloud...the cloud". A cloud being a huge blindspot where almost anything could be happening that you won't see coming until the split second when it hits you.
So, we can make an educated guess and say with almost complete certainty that 2021 will report a new record number of CVE's. The beat goes on...