Spanish Police Arrest SIM Swappers Who Stole Money from Victims Bank Accounts

Spain's National Police Agency, the Policía Nacional, said last week it dismantled an unnamed cybercriminal organization and arrested eight individuals in connection with a series of SIM swapping attacks that were carried out with the goal of financial fraud. The suspects of the crime ring...

VulnCheck KEV: CVE-2022-0429

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability...

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability. PoC POST /"/onmouseover=alert1;// HTTP/1.1 Host: 127.0.0.1 Content-Type:...

CVE-2021-45386

creationtimestamp| type| source ---|---|--- 2022-02-11 20:35:03+00:00| seen| https://t.me/cibsecurity/37335...

CVE-2022-24002

Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity...

CVE-2022-24002

Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity...

CVE-2022-22292

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity...

Code injection

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity...

CVE-2022-22292

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity...

PT-2022-16404 · Unknown · Link Sharing

Name of the Vulnerable Software and Affected Versions: Link Sharing versions prior to 12.4.00.3 Description: The issue allows attackers to open protected activity via PreconditionActivity due to an improper authorization vulnerability in Link Sharing. Recommendations: For versions prior to...

PT-2022-15991 · Sreminder · Reminder

Name of the Vulnerable Software and Affected Versions: Reminder versions prior to 12.3.01.3000 Reminder versions prior to 12.2.05.6000 Reminder versions prior to 11.6.08.6000 Description: The issue is related to improper access control in the Reminder application, allowing attackers to register...

Samsung Telecom 安全漏洞

Samsung Telecom is a communication feature for Samsung Samsung mobile devices. Samsung Telecom suffers from an authorization issue vulnerability that stems from a lack of proper privileges for dynamic receivers in Telecom, which could be exploited by an attacker to launch arbitrary activity...

SAMSUNG Link Sharing 安全漏洞

SAMSUNG Link Sharing is a file sharing application from Samsung South Korea. It makes it easy to upload large files, high-resolution images, videos and documents saved on a Samsung Galaxy device or Samsung Pc to the Samsung Cloud for a period of time, create links to those files, and then easily...

CVE-2021-45357

Cross Site Scripting XSS vulnerability exists in Piwigo 12.x via the pwgactivity function in include/functions.inc.php...

CVE-2022-24663

creationtimestamp| type| source ---|---|--- 2022-02-10 16:20:00+00:00| seen| https://t.me/truesecator/2616 2022-02-16 20:42:08+00:00| seen| https://t.me/cibsecurity/37600...

Vulnerability discovered in NetApp Clustered Data ONTAP

NetApp has discovered a vulnerability in Clustered Data ONTAP. The vulnerability is located in the version of the provided tool Expat and allows a malicious party to gain access to sensitive data, potentially to manipulate it, or to cause a Denial-of-Service. NetApp has not released any updates a...

Mastodon 安全漏洞

Mastodon is an open source social network server based on ActivityPub. Mastodon suffers from a security vulnerability that stems from incorrect access control, as it does not compress incoming signed JSON-LD activities...

Moodle 3.11.4 - SQL Injection

Exploit Title: Moodle 3.11.4 - SQL Injection Date: 30/01/2022 Exploit Author: lavclash75 Vendor Homepage: https://moodle.org/ Version: Moodle 3.11 to 3.11.4 CVE: CVE-2022-0332 POC GET...

Moodle 3.11.4 - SQL Injection Vulnerability

Exploit Title: Moodle 3.11.4 - SQL Injection Exploit Author: lavclash75 Vendor Homepage: https://moodle.org/ Version: Moodle 3.11 to 3.11.4 CVE: CVE-2022-0332 POC GET...

GHSA-6JHM-4VMX-MR76 SQL injection in Moodle

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data...