Project: Drupal coreDate: 2023-January-18Security risk: Moderately critical 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information DisclosureAffected versions: >=8.0.0 =9.5.0 =10.0.0 Description: The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access.The vulnerability is mitigated by the fact that the
More info:
https://www.drupal.org/sa-core-2023-001
The landscape of cyber risks continues to create a sea change affecting many areas of the industry. From regulatory compliance mandates to customer and partner-led requirements, this isn’t anything new. However, one area that’s starting to feel newer for many organizations is the realm of cyber insurance. In a recent blog post by Karen Worstell, … ContinuedThe post Requirements for Cyber Insurance are Changing…Fast! appeared first on VMware Security Blog.
More info:
https://blogs.vmware.com/security/2023/01/requirements-for-cyber-insurance-are-changingfast.html?utm_source=rss&utm_medium=rss&utm_campaign=requirements-for-cyber-insurance-are-changingfast
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which
More info:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WbMQqNJh?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Email%20Security%20Appliance%20URL%20Filtering%20Bypass%20Vulnerability&vs_k=1
Cisco IOS Software and Cisco IOS XE Software images come in two types: The regular universalk9 image and the No Payload Encryption (NPE) universalk9_npe image. NPE images were introduced to satisfy import requirements in some countries that require that the platform does not support strong payload cryptography. As such, NPE images lack support for certain cryptographic features, most notably IPsec VPN and Secure Unified Communications. As result, when running an NPE image, the CLI parser no
More info:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-npe-hardening-Dkel83jP?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Identifying%20and%20Mitigating%20Security%20Exposures%20When%20Using%20No%20Payload%20Encryption%20Images%20with%20Existing%20Cryptographic%20Configuration&vs_k=1
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged
More info:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-sql-rpPczR8n?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Unified%20Communications%20Manager%20SQL%20Injection%20Vulnerability&vs_k=1
More info:
https://www.oracle.com/security-alerts/cpujan2023.html
