10173 matches found
APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers
APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742. Overview and Context The UK National Cyber Security Centre NCSC, the US National Security Agency NSA, US Cybersecurity and Infrastructure Security Agency CISA and US Federal Bureau of...
Directory traversal
The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...
CVE-2022-34126
The vulnerability CVE-2022-34126 affects the GLPI Activity plugin prior to 3.1.1. Root cause: directory traversal in the front/cra.send.php parameter allows reading local files. Impact: potential exposure of sensitive information due to unauthorized local file access. Affected component: GLPI Act...
CVE-2022-34126
The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...
GLPI Activity 路径遍历漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
PT-2023-13338 · Glpi · Glpi Activity Plugin
Name of the Vulnerable Software and Affected Versions: GLPI Activity plugin versions prior to 3.1.1 Description: The issue allows reading local files via directory traversal in the "front/cra.send.php" file parameter. This can potentially lead to unauthorized access to sensitive information...
CVE-2022-34126
The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...
Design/Logic Flaw
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki...
CVE-2022-43697
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...
Cross site scripting
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...
CVE-2022-43697
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...
CVE-2022-43697
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...
CVE-2022-43697
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...
PT-2023-14289 · Open Xchange · Ox App Suite
Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for cross-site scripting XSS via an activity tracking adapter defined by jslob. This can potentially lead to malicious script execution on the client-side...
CVE-2022-43697
OX App Suite (Open-Xchange) prior to 7.10.6-rev30 is vulnerable to cross-site scripting via an activity tracking adapter defined by jslob. The root cause is an XSS flaw in how the adapter processes input, enabling injected scripts to run in the client when the affected interface is used. Affected...
Threat actors strive to cause Tax Day headaches
Threat actors often take advantage of current events and major news headlines to align attacks and leverage social engineering when people could be more likely to be distracted or misled. Tax season is particularly appealing to threat actors because not only are people busy and under stress, but ...
PT-2023-4805 · Ckeditor +1 · Ckeditor +1
Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 13.10.11 XWiki versions prior to 14.4.7 XWiki versions prior to 14.10 Description: The issue allows any user with view rights on commonly accessible documents, including the legacy notification activity macro, to execu...
U.S. Dept Of Defense: Default Credentials on Kinetic Core System Console - https://█████/kinetic/app/
Weak default credentials of "admin/admin" were discovered on the Kinetic Core System Console application, potentially allowing attackers to identify underlying technologies and access sensitive information such as server logs and user data. The vulnerability was present in version 2.1.0-SNAPSHOT...
CVE-2022-27597
creationtimestamp| type| source ---|---|--- 2023-04-04 07:07:04+00:00| seen| https://t.me/ctinow/103450 2023-04-04 11:36:39+00:00| seen| https://t.me/ctinow/103480 2023-04-07 14:00:05+00:00| seen| https://t.me/truesecator/4265...
Pre-ransomware notifications are paying off right from the bat
CISA Cybersecurity and Infrastructure Security Agency has published the first results of its pre-ransomware notifications that were introduced at the start of 2023. Even though this initiative is relatively young, CISA says it has notified over 60 entities across the energy, healthcare,...