CVE-2022-39900

Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch...

CVE-2022-38379

Fortinet FortiSOAR is affected by CVE-2022-38379 (CWE-79): improper neutralization of input during web page generation, enabling an authenticated attacker to inject HTML tags through input fields in FortiSOAR versions 7.0.0–7.0.3 and 7.2.0. The connected documents confirm the vulnerability in For...

How the Modern Data Landscape Made the Traditional Cybersecurity Approach Obsolete

From the news headlines, we know that data breaches are on the rise - both in frequency and scale. While this reality is unsettling, it’s not surprising. That is because the volume of data being collected and stored by organizations continues to grow exponentially each year. Every day, the global...

The 5 Core Principles of the Zero-Trust Cybersecurity Model

When even the US Government concludes that to ensure baseline security practices are in place and to realize the security benefits of cloud-based infrastructure while mitigating associated risks, they must migrate to a zero-trust model, every organization should be actively moving in that...

Helmet Store Showroom 1.0 SQL Injection Exploit

Exploit Title: Helmet Store Showroom 1.0 - authenticated SQL Injection Exploit Author: syad Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/15851/helmet-store-showroom-site-php-and-mysql-free-source-code.html Version: 1.0 Tested on: Windows 10 +...

CVE-2022-36193

SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries...

oldoakgdr.it Cross Site Scripting vulnerability OBB-3071521

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE SLED15: WebKit2GTK-4.0-lang / WebKit2GTK-4.1-lang / WebKit2GTK-5.0-lang / etc (SUSE-SU-2022:4207-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4207-1 advisory. Security fixes: - CVE-2022-32888: Fixed possible arbitrary code execution via maliciously crafte...

Zero Reasons not to Move to Zero Trust with RASP

What is Zero Trust? Zero Trust is a security methodology that enterprises are rapidly adopting to enhance data protection by reducing the sole reliance on traditional perimeter-based protections. Traditionally, cybersecurity strategies have relied on a hardened perimeter with security tools like...

CVE-2021-35246

The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users...

CVE-2022-45047

A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server. Mitigation From the maintainer: For Apache MINA SSHD =...

CVE-2022-44787

CVE-2022-44787 affects Maggioli Maggioli SpA Appalti & Contratti, version 9.12.2. The vulnerability is a reflected Cross-Site Scripting (XSS) in the web application where the idPagina parameter is reflected in the server response without HTML encoding, allowing/script injection when a user intera...

CVE-2022-44785

CVE-2022-44785 affects Maggioli Maggioli SpA Appalti & Contratti v9.12.2. The vulnerability class is SQL injection in multiple parameters, with at least one instance operable by unauthenticated users (notably cfamm in GetListaEnti.do). Reports from multiple sources (Red Hat, NVD, CVE/CVE list, PT...

3 Types of SQLi in `s` param - (Time/Boolean/Error Based)

Description I have found 3 types of SQLi on the s parameter Proof of Concept Time-Based Time-based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time in seconds before...

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service. The vulnerability exists Databuf function of rafimage.cpp due to a null pointer dereference which allows an attacker to crash the application via malicious input...

Rapid7 Takes Home 2 Awards and a Highly Commended Recognition at the 2022 Belfast Telegraph IT Awards

Rapid7 was honored at the Belfast Telegraph's annual IT Awards, Friday, taking home a pair of awards including the coveted “Best Place to Work in IT” in the large company category award, and the “Cyber Security Project of the Year” award, for groundbreaking machine learning research in applicatio...

F5 BIG-IP 跨站请求伪造漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP. An attacker exploited the vulnerability to perform cross-site request forgery via iControl SOAP...

CVE-2022-43135

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php...

Input validation

In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these...

Cross-Site Request Forgery (CSRF)

Concrete CMS is vulnerable to cross-site request forgery. The vulnerability exists in multiple functions due to lack of checks in the State parameter for external concrete authentication service which allows an attacker to initiate unwanted actions within the web application...