CVE-2022-34773

Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of OWASP:API8 – Injection...

kkFileView 跨站脚本漏洞

Keking kkFileView is a Spring-Boot project for online previewing of documents by Keking Technology Keking. A cross-site scripting vulnerability exists in kkFileView v4.1.0, which originates from multiple cross-site scripts in the urls and currentUrl parameters of the...

CVE-2022-38184

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs...

Exposure of client IP addresses in net/http

...

Discourse < 2.8.7 DoS Vulnerabilities

Discourse is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"...

CVE-2022-38187

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

CVE-2022-33993

Misinterpretation of special domain name characters in DNRD aka Domain Name Relay Daemon 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form...

CVE-2022-33993

Misinterpretation of special domain name characters in DNRD aka Domain Name Relay Daemon 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form...

CVE-2022-33990

Misinterpretation of special domain name characters in dproxy-nexgen aka dproxy nexgen leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form...

Esri Portal For ArcGis 安全漏洞

Esri Portal For ArcGis is a component of Esri, Inc. that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Esri Portal For ArcGis versions prior to 10.9.0 that stems from an anonymous user always...

Killnet Claim They’ve Stolen Employee Data from Lockheed Martin

By Waqas The pro-Russia Killnet hacker group claims that the stolen information includes PII data such as email addresses and… This is a post from HackRead.com Read the original post: Killnet Claim Theyve Stolen Employee Data from Lockheed Martin...

CVE-2022-28755

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attack...

CVE-2022-32148

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the...

CVE-2022-32148 Exposure of client IP addresses in net/http

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the...

New IoT RapperBot Malware Targeting Linux Servers via SSH Brute-Forcing Attack

A new IoT botnet malware dubbed RapperBot has been observed rapidly evolving its capabilities since it was first discovered in mid-June 2022. "This family borrows heavily from the original Mirai source code, but what separates it from other IoT malware families is its built-in capability to brute...

CVE-2022-33722

Implicit Intent hijacking vulnerability in Smart View prior to SMR Aug-2022 Release 1 allows attacker to access connected device MAC address...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from South Korea's Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices Smart View Module SMR Aug-2022 Release 1 prior to Release 1, which stems from the presence of an implic...

PT-2022-19150 · Unknown +1 · Freshtomato +1

Name of the Vulnerable Software and Affected Versions: FreshTomato version 2022.1 Description: A memory corruption issue exists in the httpd unescape functionality. This can be triggered by a specially-crafted HTTP request, leading to memory corruption. An attacker can exploit this by sending a...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.18 (SUSE-SU-2022:2672-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2672-1 advisory. Update to go version 1.18.5 bsc1193742: - CVE-2022-32189: encoding/gob, math/big: decoding...

The vulnerability of the Mozilla Firefox browser arises due to insufficient validation of input data, allowing attackers to trigger a service failure.

The vulnerability of the Mozilla Firefox browser exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by visiting websites with overly long URL addresses...