New RIG Exploit Kit Campaign Infecting Victims' PCs with RedLine Stealer

A new campaign leveraging an exploit kit has been observed abusing an Internet Explorer flaw patched by Microsoft last year to deliver the RedLine Stealer trojan. "When executed, RedLine Stealer performs recon against the target system including username, hardware, browsers installed, anti-virus...

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware

A China-linked government-sponsored threat actor observed striking European diplomatic entities in March may have been targeting Russian government officials with an updated version of a remote access trojan called PlugX. Secureworks attributed the attempted intrusions to a threat actor it tracks...

Tenda AX12 Cross-Site Request Forgery Vulnerability (CNVD-2022-63550)

Tenda AX12 is a dual-band Gigabit Wifi 6 wireless router from Tenda, China.Tenda AX12 V22.03.01.21CN firmware version is vulnerable to cross-site request forgery, which is caused by the sub422168 function of /goform/WifiExtraSet that does not sufficiently validate whether the request is from a...

Tenda AX12 Cross-Site Request Forgery Vulnerability (CNVD-2022-63551)

Tenda AX12 is a dual-band gigabit Wifi 6 wireless router from Tenda, China.Tenda AX12 V22.03.01.21CN is vulnerable to cross-site request spoofing. users, an attacker could use the vulnerability to spoof malicious requests to trick victims into clicking to perform sensitive operations...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37377)

Reolink Rlc-410W is a Wifi security camera from Reolink China.Reolink RLC-410W version v3.0.0.13620121102 contains a security vulnerability that can be exploited by attackers to cause a reboot via a compiled HTTP request...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37380)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

zlog buffer overflow vulnerability

zlog is a reliable , high-performance , thread-safe , flexible , model-clear pure C logging library of China Hardy Simpson individual developers . A buffer overflow vulnerability exists in zlog version 1.2.15, which stems from a buffer overflow in zlogconfbuildwithfile in src/zlog/src/conf.c. The...

NI Web Server 跨站脚本漏洞

NI Web Server is a web server from NI China. A security vulnerability exists in NI Web Server. No information about the vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...

ZZCMS Cross-Site Scripting Vulnerability (CNVD-2022-71404)

ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS 2021 is vulnerable to a cross-site scripting vulnerability that originates from a lack of restriction and filtering of user parameters in admanage.php. An attacker could exploit this vulnerability to execute client-side...

Huawei EMUI Code Execution Vulnerability (CNVD-2022-64481)

Huawei EMUI is an Android-based mobile operating system developed by the Chinese company Huawei Huawei. A code execution vulnerability exists in Huawei EMUI, which is caused by an arbitrary address access vulnerability in the product line test code. An attacker can exploit this vulnerability to...

ZZCMS SQL Injection Vulnerability (CNVD-2022-56482)

ZZCMS is a content management system CMS from the Zzcms team in China. zzCMS2021 is vulnerable to SQL injection, which stems from a lack of filtering of SQL data in admanage.php. An attacker could use this vulnerability to send malicious SQL commands...

Weekly Threat Digest: 4 – 10 April 2022

For a detailed threat digest, download the pdf file here Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 438 3 3 53 16 54 The second week of April 2022 witnessed the discovery of 438 vulnerabilities out of which 3 gaine...

zbzcms arbitrary file upload vulnerability (CNVD-2022-30432)

zbzcms station helper CMS is a content management website of China station helper CMS zbzcms company. zbzcms version 1.0 has an arbitrary file upload vulnerability, which can be exploited by attackers to execute arbitrary code via specially crafted PHP files...

编号已被CVE保留

No details are available at this time...

zbzcms SQL Injection Vulnerability (CNVD-2022-30430)

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a SQL injection vulnerability, which originates from a SQL injection vulnerability found through the id parameter of /php/ajax.php. No detailed vulnerability details are...

zbzcms arbitrary file upload vulnerability

zbzcms station helper CMS is a content management website of China station helper CMS zbzcms company. zbzcms version 1.0 has an arbitrary file upload vulnerability, which can be exploited by attackers to execute arbitrary code via specially crafted PHP files...

zbzcms cross-site scripting vulnerability

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a cross-site scripting vulnerability, no detailed vulnerability details are currently available...

zbzcms SQL Injection Vulnerability

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a SQL injection vulnerability, which originates from a SQL injection vulnerability found through the art parameter of /include/make.php. No detailed vulnerability details are...

zbzcms access control error vulnerability

zbzcms Station Helper CMS is a content management website from China Station Helper CMS zbzcms. zbzcms version 1.0 is vulnerable to an access control error, which can be exploited by attackers to arbitrarily add administrator accounts...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux Kernel. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor's announcement...