Code injection

Applicable to China models only Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allows untrusted applications to get WiFi information without proper permission...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. The product features application performance management, fault management, report generation, and SLA management.A security vulnerability exists in Zoho ManageEngine Applications Manager, which stems fr...

Samsung SMR security vulnerabilities

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in Samsung SMR that stems from sensitive data being stored in an unprotected BluetoothSettingsProvider, which could allow an untrusted application t...

PT-2022-8906

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to build 14550 Description A vulnerability in the showReports module allows authenticated attackers to execute a SQL injection via a crafted request. Recommendations For versions prior to...

github-readme-stats cross-site scripting vulnerability

github-readme-stats is an open source project. github-readme-stats suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by WEB applications, which can be exploited by attackers to execute client-side code...

CVE-2020-28679: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request...

vulhub

This is an open-source collection of vulnerable systems and applications for educational purposes. The repository is maintained by phith0n and is available on GitHub. It contains a variety of vulnerable systems and applications, including web applications, databases, and operating systems. The...

CVE-2022-22270

An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information...

CVE-2022-22269

CVE-2022-22269 – concrete details found. The vulnerability concerns an unprotected BluetoothSettingsProvider on Samsung Android devices prior to the SMR Jan-2022 Release 1. This leakage enables untrusted applications with local access to read the device’s Bluetooth MAC address. Root cause: Blueto...

CVE-2022-22263

Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity...

Security Bulletin: Apache Log4j vulnerabilities impact z/Transaction Processing Facility (z/TPF) and TPF Operations Server (CVE-2021-45105, CVE-2021-45046)

Summary The Apache Log4j vulnerabilities affect the z/Transaction Processing Facility z/TPF system and TPF Operations Server. Several Java applications on the z/TPF system depend on Apache Log4j capabilities. Additionally, the 64-bit Java support in TPF Operations Server uses Apache Log4j...

PT-2022-1488

Name of the Vulnerable Software and Affected Versions CENTUM VP versions R5.01.00 through R5.04.20 CENTUM VP versions R6.01.00 through R6.08.00 Exaopc versions R3.72.00 through R3.79.00 Description The issue is related to the use of hardcoded passwords for CAMS server applications in certain...

Wekan Cross-Site Scripting Vulnerability

Wekan is a highly finished open source kanban tool. wekan suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications. An attacker could exploit the vulnerability to execute malicious javascript code...

CVE-2022-22269: Improper Authorization

Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address...

github-readme-stats Cross-site Scripting Vulnerabilities

github-readme-stats is an open source project. github-readme-stats suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by WEB applications, which can be exploited by attackers to execute client-side code...

Vulnerability Research Highlights 2021

At SonarSource we are constantly improving our code analyzers to help developers write Clean Code. The detection of severe code vulnerabilities plays an important role in this process so that applications are protected from attacks and security breaches. For this same reason, our research team...

Security Bulletin: Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server which is bundled with IBM Cloud Pak for Applications(CVE-2021-45105, CVE-2021-44832)

Summary Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server CVE-2021-45105, CVE-2021-44832. IBM WebSphere Application Server is bundled with IBM Cloud Pak for Applications. There is a vulnerability in the Apache log4j library used by IBM WebSphere Application Server...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228scanner modified - Deprecated Original Scrip...

Workshop: Building Modern Applications with DevOps Security

In this workshop, you’ll learn how to leverage DevOps Security with your serverless applications running on AWS Lambda or containerized applications running on AWS Fargate. Learn how to make cloud security more efficient, proactive, and gain visibility...

SUSE: Security Advisory (SUSE-SU-2022:0021-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...