CVE-2022-28281

creationtimestamp| type| source ---|---|--- 2022-04-08 15:31:58+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1905 2022-04-11 09:48:20+00:00| published-proof-of-concept| https://t.me/reconshell/1243 2022-04-11 10:45:43+00:00| published-proof-of-concept| https://t.me/cKure/9323...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

CISA advises D-Link users to take vulnerable routers offline

On April 4 2022, the Cybersecurity & Infrastructure Security Agency CISA added CVE-2021-45382 to its known exploited vulnerabilities catalog. But since the affected products have reached end of life EOL, the advice is to disconnect them, if still in use. CISA catalog The CISA catalog of known...

QNAP QTS / QuTS Hero DEADBOLT Ransomware (QSA-22-02)

The version of QNAP QTS / QuTS Hero installed on the remote host is affected by an arbitrary code execution vulnerability which is being actively exploited by the DEADBOLT ransomware. The ransomware encrypts files, renames them with a .deadbolt extension and hijacks the login page with a ransom...

CVE-2022-26572

creationtimestamp| type| source ---|---|--- 2022-04-04 22:27:55+00:00| seen| https://t.me/cibsecurity/40112...

Barco Control Room Management Suite Directory Traversal

I. SUMMARY Title: CVE-2022-2623 Barco Control Room Management Suite File Path Traversal Vulnerability Product: Barco Control Room Management Suite before 2.9 build 0275 and all prior versions Vulnerability Type: File Path Traversal Credit by/Researcher: Murat Aydemir from Accenture Cyber Security...

CVE-2022-1018 ICSA-22-088-01 Rockwell Automation ISaGRAF

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...

CVE-2022-0922 ICSMA-22-088-01 Philips e-Alert

The software does not perform any authentication for critical system functionality...

Mitsubishi Electric FA Products

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: FA products Vulnerabilities: Use of Password Hash Instead of Password for Authentication, Use of Weak Hash, Cleartext Storage of Sensitive Information, Authentication Bypass by Capture-replay...

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

CVE-2021-22797

CVE-2021-22797 is a CWE-22 path traversal vulnerability in Schneider Electric EcoStruxure Control Expert (incl. Unity Pro), EcoStruxure Process Expert, and SCADAPack RemoteConnect for x70. The root cause is improper validation of a user-supplied path when loading a malicious project file, which c...

CVE-2021-22797

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

CVE-2021-22794

CVE-2021-22794 is a path traversal vulnerability in Schneider Electric’s StruxureWare Data Center Expert (versions 7.8.1 and prior). The issue arises from improper validation of user-supplied input in path handling, enabling remote code execution over the network with no authentication required a...

CVE-2021-22794

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

CISA Adds 32 Known Exploited Vulnerabilities to Catalog

CISA has added 32 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

ImpressCMS 1.4.2 Path Traversal Vulnerability

----------------------------------------------------------------- ImpressCMS getVar 'imagename' 162. if @unlink ICMSIMANAGERFOLDERPATH . '/temp/' . $simagetemp 163. $msg = MDAMDBUPDATED; ... 190. else 191. if copy ICMSIMANAGERFOLDERPATH . '/temp/' . $simagetemp, $categpath . $imgname 192. @unlink...

legacy.weathermodels.com Cross Site Scripting vulnerability OBB-2442140

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-25484

creationtimestamp| type| source ---|---|--- 2022-03-22 19:28:02+00:00| seen| https://t.me/cibsecurity/39384...

CVE-2021-43650

creationtimestamp| type| source ---|---|--- 2022-03-22 19:27:59+00:00| seen| https://t.me/cibsecurity/39382...

lacianeva.com Cross Site Scripting vulnerability OBB-2441392

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...