MITRE has released version 4.14 of the Common Weakness Enumeration (CWE) with a new weakness for "Hardware Micro Architectures", a view for "ISA/IEC 62443 Requirements", and new demonstrative examples from "HACK@DAC". Changes in 4.14 New Waknesses: CWE-1420: Exposure of Sensitive Information du...
Read more
This new version of SecDB brings new features and improvements. Polished UI, improved support for EPSS, Web & Social references (from Reddit and Mastodon) in CVEs, new Security Advisories and sections (NASL & NVT and Packages), and much more. Improved the EPSS (Exploit Prediction Scoring System) s...
Read more
Notable changes in SecDB Introduced the Exploit Prediction Scoring System (EPSS) Added the Exploit Prediction Scoring System (EPSS) score in all tables and CVE pages. The Exploit Prediction Scoring System (EPSS) is an open, data-driven effort for estimating the likelihood (probability) that a sof...
Read more
MITRE has published the 2022 CWE Top 25 Most Dangerous Software Weaknesses list (aka CWE™ Top 25), based on an analysis of 38000 CVEs published from the previous two years. To create the list, the CWE Team leveraged Common Vulnerabilities and Exposures (CVE®) data found within the National Institu...
Read more
Cybersecurity & Infrastructure Security Agency (CISA) has added 34 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. https://www.cisa.gov/uscert/ncas/current-activity/2022/05/25/cisa-adds-34-known-exploited-vulnerabilities-catalog ...
Read more
Cybersecurity & Infrastructure Security Agency (CISA) has added 20 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. https://www.cisa.gov/uscert/ncas/current-activity/2022/05/24/cisa-adds-20-known-exploited-vulnerabilities-catalog ...
Read more
Computer Security Incident Response Team - Italia (CSIRT) has published 71 known vulnerabilities based on evidence of active exploitation. https://www.csirt.gov.it/contenuti/analisi-delle-principali-vulnerabilita-sfruttate-in-campagne-cyber-pubblicamente-attribuite-ad-attori-di-matrice-russa-e-rela...
Read more
tl;dr nmap-log4shell (https://github.com/giterlizzi/nmap-log4shell) is a NSE script for discovery Apache Log4j RCE (CVE-2021-44228) vulnerability across the network. The script is able to inject the log4shell exploit payload via HTTP Headers (default) or via TCP/UDP socket. Vulnerability CVE-2021...
Read more