Design/Logic Flaw

Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address...

Samsung SMR安全漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in Samsung SMR that stems from sensitive data being stored in an unprotected BluetoothSettingsProvider, which could allow an untrusted application t...

Zoho ManageEngine Applications Manager SQL注入漏洞

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. The product features application performance management, fault management, report generation, and SLA management.A security vulnerability exists in Zoho ManageEngine Applications Manager, which stems fr...

github-readme-stats cross-site scripting vulnerability

github-readme-stats is an open source project. github-readme-stats suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by WEB applications, which can be exploited by attackers to execute client-side code...

vulhub

This is an open-source collection of vulnerable systems and applications for educational purposes. The repository is maintained by phith0n and is available on GitHub. It contains a variety of vulnerable systems and applications, including web applications, databases, and operating systems. The...

CVE-2022-22270

An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information...

CVE-2022-22269

CVE-2022-22269 – concrete details found. The vulnerability concerns an unprotected BluetoothSettingsProvider on Samsung Android devices prior to the SMR Jan-2022 Release 1. This leakage enables untrusted applications with local access to read the device’s Bluetooth MAC address. Root cause: Blueto...

CVE-2022-22263

Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity...

Security Bulletin: Apache Log4j vulnerabilities impact z/Transaction Processing Facility (z/TPF) and TPF Operations Server (CVE-2021-45105, CVE-2021-45046)

Summary The Apache Log4j vulnerabilities affect the z/Transaction Processing Facility z/TPF system and TPF Operations Server. Several Java applications on the z/TPF system depend on Apache Log4j capabilities. Additionally, the 64-bit Java support in TPF Operations Server uses Apache Log4j...

Wekan Cross-Site Scripting Vulnerability

Wekan is a highly finished open source kanban tool. wekan suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications. An attacker could exploit the vulnerability to execute malicious javascript code...

Vulnerability Research Highlights 2021

At SonarSource we are constantly improving our code analyzers to help developers write Clean Code. The detection of severe code vulnerabilities plays an important role in this process so that applications are protected from attacks and security breaches. For this same reason, our research team...

github-readme-stats 跨站脚本漏洞

github-readme-stats is an open source project. github-readme-stats suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by WEB applications, which can be exploited by attackers to execute client-side code...

Security Bulletin: Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server which is bundled with IBM Cloud Pak for Applications(CVE-2021-45105, CVE-2021-44832)

Summary Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server CVE-2021-45105, CVE-2021-44832. IBM WebSphere Application Server is bundled with IBM Cloud Pak for Applications. There is a vulnerability in the Apache log4j library used by IBM WebSphere Application Server...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228scanner modified - Deprecated Original Scrip...

ZOHO ManageEngine ADSelfService Plus has an unspecified vulnerability (CNVD-2022-02472)

A security vulnerability exists in ZOHO ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. The vulnerability is caused by ManageEngine ADSelfService Plus under build 6116 storing the password...

Workshop: Building Modern Applications with DevOps Security

In this workshop, you’ll learn how to leverage DevOps Security with your serverless applications running on AWS Lambda or containerized applications running on AWS Fargate. Learn how to make cloud security more efficient, proactive, and gain visibility...

SUSE: Security Advisory (SUSE-SU-2022:0021-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-43832

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

What you need to know about how cryptography impacts your security strategy

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest post of our Voice of the Community blog series post, Microsoft Security Product Marketing Manager Natalia Godyla talks with Taurus SA Co-founder...

2021 in Review, Part 4: 5 Cybersecurity Topics to Watch in 2022

One of the core principles of cybersecurity is not letting things “slip through the cracks”. An effective security posture depends on visibility. The more visibility you have into the environments where your data is, the more successful you will be in applying your organization’s security protoco...