‼ CVE-2022-44001 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43179 ‼
📖 Read
via "National Vulnerability Database".
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31608 ‼
📖 Read
via "National Vulnerability Database".
Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45071 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3090 ‼
📖 Read
via "National Vulnerability Database".
Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39389 ‼
📖 Read
via "National Vulnerability Database".
Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33897 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43192 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43183 ‼
📖 Read
via "National Vulnerability Database".
XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.📖 Read
via "National Vulnerability Database".
🕴 Analysts Welcome NSA's Advice for Developers to Adopt Memory-Safe Languages 🕴
📖 Read
via "Dark Reading".
Languages such as C and C++ rely too heavily on the programmer not making simple memory-related security errors.📖 Read
via "Dark Reading".
Dark Reading
Analysts Welcome NSA's Advice for Developers to Adopt Memory-Safe Languages
Languages such as C and C++ rely too heavily on the programmer not making simple memory-related security errors.
‼ CVE-2022-44736 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38165 ‼
📖 Read
via "National Vulnerability Database".
WithSecure through 2022-08-10 allows attackers to cause a denial of service (issue 4 of 5).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36786 ‼
📖 Read
via "National Vulnerability Database".
DLINK - DSL-224 Post-auth PCE. DLINK router has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36784 ‼
📖 Read
via "National Vulnerability Database".
Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36357 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ULTIMATE TABLES plugin <= 1.6.5 on WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23748 ‼
📖 Read
via "National Vulnerability Database".
mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36787 ‼
📖 Read
via "National Vulnerability Database".
Webvendome - Webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number=HERE.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41775 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28766 ‼
📖 Read
via "National Vulnerability Database".
Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20460 ‼
📖 Read
via "National Vulnerability Database".
In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239557547References: N/A📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36905 ‼
📖 Read
via "National Vulnerability Database".
Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.📖 Read
via "National Vulnerability Database".