PT-2022-18729 · Cynet · Cynet 360 Web Portal

Name of the Vulnerable Software and Affected Versions: Cynet 360 Web Portal versions prior to 4.5 Description: The issue allows attackers to access a list of decoy users via a crafted GET request sent to "/WebApp/DeceptionUser/GetAllDeceptionUsers". Recommendations: For versions prior to 4.5,...

Web Port 授权问题漏洞

Web Port is a web-based SCADA data acquisition and monitoring system and HMI human machine interface system. A security vulnerability exists in Cynet 360 Web Portal versions prior to v4.5, which stems from a vulnerability that allows an attacker to access a list of excluded files and configuratio...

Mirai Variant MooBot Botnet Exploiting D-Link Router Vulnerabilities

A variant of the Mirai botnet known as MooBot is co-opting vulnerable D-Link devices into an army of denial-of-service bots by taking advantage of multiple exploits. "If the devices are compromised, they will be fully controlled by attackers, who could utilize those devices to conduct further...

360-Degree XDR and Attack Surface Coverage With Rapid7

Today’s already resource-constrained security teams are tasked with protecting more as environments sprawl and alerts pile up, while attackers continue to get stealthier and add to their arsenal. To be successful against bad actors, security teams need to be proactive against evolving attacks in...

Security Bulletin: CP4D Match 360 is affected by Identity Spoofing vulnerability in IBM WebSphere Application Server Liberty

Summary IBM WebSphere Application Server Liberty is vulnerable to identity spoofing with the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0 or appSecurity-4.0 feature enabled. This has been addressed. IBM Match 360 v4.5.0 and prior, is also vulnerable given that it uses WebSphere Application...

Security Bulletin: CP4D Match 360 is impacted due to vulnerability in IBM WebSphere Application Server Liberty Information Disclosure (CVE-2022-22393)

Summary IBM WebSphere Application Server Liberty is vulnerable to an information disclosure with the adminCenter-1.0 feature enabled. This has been addressed. IBM Match 360 v4.5.0 and prior, is also vulnerable given that it uses WebSphere Application Server Liberty. Vulnerability Details...

Exploit for Type Confusion in Linux Linux_Kernel

CVE-2022-34918 LPE POC 尝试结合了一下360提出的USMAhttps://vul.360.ne...

CVE-2022-27873

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

CVE-2022-27873

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

CVE-2022-27873

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

Information disclosure

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

CVE-2022-27873

CVE-2022-27873 affects Autodesk Fusion 360 through the document parser’s Insert SVG pathway. The affected component is the SVG insertion logic in Fusion 360, which can cause the application to initiate arbitrary HTTP requests and potentially disclose the victim’s public IP (and possibly other inf...

CVE-2022-27873

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

PT-2022-18658 · Autodesk · Autodesk Fusion 360

Name of the Vulnerable Software and Affected Versions: Autodesk Fusion 360 affected versions not specified Description: The issue allows an attacker to force a victim's device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360's document...

dmt-360.com Cross Site Scripting vulnerability OBB-2668994

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Autodesk Fusion 360 Installed (macOS)

Binary data macosautodeskfusion360installed.nbin...

macOS Autodesk Fusion 360 < 2.0.12888 XXE (adsk-sa-2022-0013)

The version of Autodesk Fusion 360 installed on the remote macOS or Mac OS X host is prior to 2.0.12888. It is, therefore, affected by an XML external entity XXE vulnerability that can cause a victim to perform arbitrary HTTP requests when parsing a malicious SVG file. An unauthenticated, remote...

Owl Labs Meeting Owl Licensing Issue Vulnerability (CNVD-2022-64972)

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Featuring a series of cameras and microphones that capture 360-degree video and audio and automatically focus on the speaker, making meetings more dynamic and inclusive, Owl Labs Meeting Owl version 5.2.0.15 is vulnerable to ...

Owl Labs Meeting Owl Licensing Issue Vulnerability

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Equipped with an array of cameras and microphones, it captures 360-degree video and audio and automatically focuses on the speaker, making meetings more dynamic and inclusive.Owl Labs Meeting Owl version 5.2.0.15 is vulnerabl...

Security Bulletin: CP4D Match 360 is vulnerable to remote attacker executing arbitrary code within IBM WebSphere Application Server Liberty (CVE-2021-23450)

Summary Summary: CP4D Match 360 is vulnerable to remote attacker executing arbitrary code within IBM WebSphere Application Server Liberty CVE-2021-23450. Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the setObject function. By sendi...