‼ CVE-2022-2356 ‼
📖 Read
via "National Vulnerability Database".
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1323 ‼
📖 Read
via "National Vulnerability Database".
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36267 ‼
📖 Read
via "National Vulnerability Database".
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2367 ‼
📖 Read
via "National Vulnerability Database".
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2269 ‼
📖 Read
via "National Vulnerability Database".
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35489 ‼
📖 Read
via "National Vulnerability Database".
In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2355 ‼
📖 Read
via "National Vulnerability Database".
The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35493 ‼
📖 Read
via "National Vulnerability Database".
A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2426 ‼
📖 Read
via "National Vulnerability Database".
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2391 ‼
📖 Read
via "National Vulnerability Database".
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36264 ‼
📖 Read
via "National Vulnerability Database".
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename and append a relative path that will be interpreted during the upload process. Using this method, it is possible to rewrite any file in the system or upload a new file.📖 Read
via "National Vulnerability Database".
🕴 Dark Reading News Desk: Live at Black Hat USA 2022 🕴
📖 Read
via "Dark Reading".
LIVE: Dark Reading News Desk at Black Hat USA 2022📖 Read
via "Dark Reading".
Dark Reading
Dark Reading News Desk: Live at Black Hat USA 2022
Dark Reading News Desk returns to Black Hat USA 2022
🛠 American Fuzzy Lop plus plus 4.02c 🛠
📖 Read
via "Packet Storm Security".
Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc.📖 Read
via "Packet Storm Security".
Packetstormsecurity
American Fuzzy Lop plus plus 4.02c ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🔏 How to Prevent Ransomware: 7 Tips to Avoid a Ransomware Attack 🔏
📖 Read
via "".
Trying to prevent ransomware at your organization? Having backups in place and an incident response plan are only part of it. Here are some tips on preventing and mitigating ransomware attacks.📖 Read
via "".
‼ CVE-2022-34293 ‼
📖 Read
via "National Vulnerability Database".
wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15109 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-15106 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-2588 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-2593 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-2631 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41615 ‼
📖 Read
via "National Vulnerability Database".
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.📖 Read
via "National Vulnerability Database".