‼ CVE-2020-36548 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45025 ‼
📖 Read
via "National Vulnerability Database".
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31784 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2111 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2113 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33915 ‼
📖 Read
via "National Vulnerability Database".
Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local privilege escalation. This Hotpatch package is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 or CVE-2021-45046; it provides a temporary mitigation to CVE-2021-44228 by hotpatching the local Java virtual machines. To do so, it iterates through all running Java processes, performs several checks, and executes the Java virtual machine with the same permissions and capabilities as the running process to load the hotpatch. A local user could cause the hotpatch script to execute a binary with elevated privileges by running a custom java process that performs exec() of an SUID binary after the hotpatch has observed the process path and before it has observed its effective user ID.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2112 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-25042 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-12359 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-12358 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31296 ‼
📖 Read
via "National Vulnerability Database".
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32276 ‼
📖 Read
via "National Vulnerability Database".
** DISPUTED ** Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36549 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41490 ‼
📖 Read
via "National Vulnerability Database".
Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33912 ‼
📖 Read
via "National Vulnerability Database".
A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the user and the group with ID 1001. If such a user exists on the system, they can change the content of these files (which are then executed by root). This leads to a local privilege escalation on the monitored host. Version 1.6 through 1.6.9p29, version 2.0 through 2.0.0p26, version 2.1 through 2.1.0p3, and version 2.2.0i1 are affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45026 ‼
📖 Read
via "National Vulnerability Database".
ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).📖 Read
via "National Vulnerability Database".
🗓️ Reddit patches CSRF vulnerability that forced users to view NSFW content 🗓️
📖 Read
via "The Daily Swig".
Mischievous hackers exploiting flaw could subvert ‘not safe for work’ restrictions📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Reddit patches CSRF vulnerability that forced users to view NSFW content
Mischievous hackers exploiting flaw could subvert ‘not safe for work’ restrictions
⚠ S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast] ⚠
📖 Read
via "Naked Security".
Lastest epsiode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]
Lastest epsiode – listen now!
‼ CVE-2022-31355 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31246 ‼
📖 Read
via "National Vulnerability Database".
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31356 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.📖 Read
via "National Vulnerability Database".