‼ CVE-2022-40876 ‼
📖 Read
via "National Vulnerability Database".
In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflow and enable remote code execution (RCE).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39977 ‼
📖 Read
via "National Vulnerability Database".
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40965 ‼
📖 Read
via "National Vulnerability Database".
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41651 ‼
📖 Read
via "National Vulnerability Database".
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41702 ‼
📖 Read
via "National Vulnerability Database".
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40967 ‼
📖 Read
via "National Vulnerability Database".
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0073 ‼
📖 Read
via "National Vulnerability Database".
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server Dashboard allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3387 ‼
📖 Read
via "National Vulnerability Database".
Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could remotely exploit vulnerable PHP code to delete .PDF files.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38395 ‼
📖 Read
via "National Vulnerability Database".
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38399 ‼
📖 Read
via "National Vulnerability Database".
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37914 ‼
📖 Read
via "National Vulnerability Database".
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator with versions 9.1.2.40051 and below, 9.0.7.40108 and below, 8.10.23.40009 and below, and any older branches of Orchestrator not specifically mentioned.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31678 ‼
📖 Read
via "National Vulnerability Database".
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-37913 ‼
📖 Read
via "National Vulnerability Database".
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator with versions 9.1.2.40051 and below, 9.0.7.40108 and below, 8.10.23.40009 and below, and any older branches of Orchestrator not specifically mentioned.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33859 ‼
📖 Read
via "National Vulnerability Database".
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary files using the file upload feature. This vulnerability is present in versions 4.x, 5.x, 6.x & 7.0 to 7.5. A new version (v7.6) containing the remediation has been made available by Eaton and a mitigation has been provided for the affected versions that are currently supported. Customers are advised to update the software to the latest version (v7.6). Foreseer EPMS versions 4.x, 5.x, 6.x are no longer supported by Eaton. Please refer to the End-of-Support notification https://www.eaton.com/in/en-us/catalog/services/foreseer/foreseer-legacy.html .📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38397 ‼
📖 Read
via "National Vulnerability Database".
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37915 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to a complete system compromise of Aruba EdgeConnect Enterprise Orchestration with versions 9.1.x branch only, Any 9.1.x Orchestrator instantiated as a new machine with a release prior to 9.1.3.40197, Orchestrators upgraded to 9.1.x were not affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36206 ‼
📖 Read
via "National Vulnerability Database".
All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.📖 Read
via "National Vulnerability Database".
⚠ S3 Ep106: Facial recognition without consent – should it be banned? ⚠
📖 Read
via "Naked Security".
Latest episode - listen (or read) now. Teachable moments for X-Ops professionals!📖 Read
via "Naked Security".
Naked Security
S3 Ep106: Facial recognition without consent – should it be banned?
Latest episode – listen (or read) now. Teachable moments for X-Ops professionals!
👍1
🗓️ VMWare patches RCE exploit in NSX Manager 🗓️
📖 Read
via "The Daily Swig".
Bug fixed despite product reaching end of life📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
VMWare patches RCE exploit in NSX Manager
End-of-life product is ‘back from the dead’ as vendor makes exception for critical bug
⚠ Updates to Apple’s zero-day update story – iPhone and iPad users read this! ⚠
📖 Read
via "Naked Security".
Turns out that Tuesday's zero-day for iOS 16 is Friday's zero-day for iOS 15...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-3322 ‼
📖 Read
via "National Vulnerability Database".
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.📖 Read
via "National Vulnerability Database".