5582 matches found
CVE-2024-47664 spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Add verification for the maxfrequency provided by the firmware If the value of maxspeedhz is 0, it may cause a division by zero error in hisicalceffectivespeed. The value of maxspeedhz is provided by firmware...
Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks
Microsoft is warning of cyber attack campaigns that abuse legitimate file hosting services such as SharePoint, OneDrive, and Dropbox that are widely used in enterprise environments as a defense evasion tactic. The end goal of the campaigns are broad and varied, allowing threat actors to compromis...
Qualys VMDR Rated as the Only Leader and Outperformer by Independent Analyst Firm for the Second Consecutive Year
Qualys VMDR received the highest possible scores for risk-based assessment, cloud-native and serverless function scanning, and flexibility of deployment, among 20 vendors evaluated in this report. As the threat landscape evolves, vulnerability management remains a cornerstone of security...
Exploit for Classic Buffer Overflow in Microsoft
EN GenWebDavIISExploit is a PoC tool demonstrating an expl...
U.S. Dept Of Defense: Time-based blind SQL injection
A time-based blind SQL injection vulnerability was discovered in the sortBy parameter of the web application's SearchDocs.aspx functionality. The vulnerability was identified by observing differences in the server's response time when specific payloads were used. This type of vulnerability could...
New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking
Misconfigured and vulnerable Linux servers are the target of an ongoing campaign that delivers a stealthy malware dubbed perfctl with the primary aim of running a cryptocurrency miner and proxyjacking software. "Perfctl is particularly elusive and persistent, employing several sophisticated...
Optigo Networks ONS-S8 - Spectra Aggregation Switch
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Optigo Networks Equipment: ONS-S8 - Spectra Aggregation Switch Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion', Weak...
U.S. Dept Of Defense: Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover
The password reset functionality of AFPC Secure allowed users to provide their Social Security Account Number SSAN and Mother's Maiden Name to reset their password. The issue was that the system informed the user if the SSAN was associated with an active PKI credential, leading to potential...
Exploit for SQL Injection in Langchain
Proof of Concept for Langchain CVE-2024–8309 Vulnerability...
CVE-2024-20508
A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...
CVE-2024-20508
A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...
CVE-2024-20455
A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense UTD component of Cisco IOS XE Software in controller mode could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability exists...
CVE-2024-20455
A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense UTD component of Cisco IOS XE Software in controller mode could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability exists...
CVE-2024-20508
Cisco UID UTD Snort IPS Engine on IOS XE is affected by CVE-2024-20508. The issue stems from insufficient validation of HTTP requests processed by the engine, allowing an unauthenticated, remote attacker to bypass security policies or trigger a reload of the Snort process, potentially leading to ...
CVE-2024-20508 Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability
A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...
CVE-2024-20508 Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability
A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability
A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...
Cisco Catalyst SD-WAN Routers Denial of Service Vulnerability
A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense UTD component of Cisco IOS XE Software in controller mode could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability exists...
U.S. Dept Of Defense: SQL Injection
The application was found to have a blind SQL injection vulnerability in the 'filterevent' parameter. The vulnerability allowed an attacker to manipulate database queries and extract sensitive information from the database through time-based or boolean-based techniques, as the injection was blind...