‼ CVE-2021-43118 ‼
📖 Read
via "National Vulnerability Database".
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21821 ‼
📖 Read
via "National Vulnerability Database".
NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26871 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42911 ‼
📖 Read
via "National Vulnerability Database".
A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code.📖 Read
via "National Vulnerability Database".
🕴 Log4j Attacks Continue Unabated Against VMware Horizon Servers 🕴
📖 Read
via "Dark Reading".
Threat actors are exploiting the vulnerability to drop Web shells and cryptominers, security vendor says.📖 Read
via "Dark Reading".
Dark Reading
Log4j Attacks Continue Unabated Against VMware Horizon Servers
Threat actors are exploiting the vulnerability to drop Web shells and cryptominers, security vendor says.
‼ CVE-2021-44082 ‼
📖 Read
via "National Vulnerability Database".
textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24771 ‼
📖 Read
via "National Vulnerability Database".
Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24769 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26244 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "special" field.📖 Read
via "National Vulnerability Database".
‼ CVE-2015-3298 ‼
📖 Read
via "National Vulnerability Database".
Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26947 ‼
📖 Read
via "National Vulnerability Database".
Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26948 ‼
📖 Read
via "National Vulnerability Database".
The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26949 ‼
📖 Read
via "National Vulnerability Database".
Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potentially exploit this vulnerability to gain access to files that should only be allowed by extra privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24693 ‼
📖 Read
via "National Vulnerability Database".
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26951 ‼
📖 Read
via "National Vulnerability Database".
Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41594 ‼
📖 Read
via "National Vulnerability Database".
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26950 ‼
📖 Read
via "National Vulnerability Database".
Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24770 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27816 ‼
📖 Read
via "National Vulnerability Database".
SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27432 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27815 ‼
📖 Read
via "National Vulnerability Database".
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.📖 Read
via "National Vulnerability Database".