‼ CVE-2022-41441 ‼
📖 Read
via "National Vulnerability Database".
Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the POBatch and WaitDuration parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48122 ‼
📖 Read
via "National Vulnerability Database".
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48126 ‼
📖 Read
via "National Vulnerability Database".
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.📖 Read
via "National Vulnerability Database".
⚠ S3 Ep118: Guess your password? No need if it’s stolen already! [Audio + Text] ⚠
📖 Read
via "Naked Security".
As always: entertaining, informative and educational... and not bogged down with jargon! Listen (or read) now...📖 Read
via "Naked Security".
Naked Security
S3 Ep118: Guess your password? No need if it’s stolen already! [Audio + Text]
As always: entertaining, informative and educational… and not bogged down with jargon! Listen (or read) now…
⚠ T-Mobile admits to 37,000,000 customer records stolen by “bad actor” ⚠
📖 Read
via "Naked Security".
Once more, it's time for Shakespeare's words: Once more unto the breach...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🤯1
‼ CVE-2021-26642 ‼
📖 Read
via "National Vulnerability Database".
When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38112 ‼
📖 Read
via "National Vulnerability Database".
In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27915 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26644 ‼
📖 Read
via "National Vulnerability Database".
SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38110 ‼
📖 Read
via "National Vulnerability Database".
In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27916 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22912 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25631 ‼
📖 Read
via "National Vulnerability Database".
Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27917 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27918 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23489 ‼
📖 Read
via "National Vulnerability Database".
The Easy Digital Downloads WordPress Plugin, version < 3.1.0.4, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47747 ‼
📖 Read
via "National Vulnerability Database".
kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23488 ‼
📖 Read
via "National Vulnerability Database".
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47732 ‼
📖 Read
via "National Vulnerability Database".
In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22964 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine ServiceDesk Plus MSP through 13003 is vulnerable to authentication bypass due to the unsafe LDAP configuration (issue 1 of 2).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43704 ‼
📖 Read
via "National Vulnerability Database".
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.📖 Read
via "National Vulnerability Database".