Microsoft Exchange ProxyLogon Collector

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework begin auxiliary class class MetasploitModule 'Microsoft Exchange ProxyLogon Collector', 'Description' = %q This module exploit a vulnerability on Microsoft Exchange Serv...

CVE-2024-6204

Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module...

CVE-2024-6204

Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module...

CVE-2024-6204 SQL injection

Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module...

CVE-2024-6204 SQL injection

Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module...

CVE-2024-6204

Product affected: Zohocorp ManageEngine Exchange Reporter Plus. Vulnerability: SQL Injection in the reports module. Affected versions: before 5715. Root cause / details: SQL injection vulnerability in the reports module (no further technical specifics provided in the cited documents). Impact (as ...

CVE-2024-8105

A flaw was found in PKfail, a firmware supply-chain issue affecting hundreds of device models in the UEFI ecosystem. The Secure Boot "master key," known as the Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often no...

IPCOM vulnerable to information disclosure

Overview SSL Accelerator/SSL-VPN Function of IPCOM provided by Fsas Technologies Inc. contains an information disclosure vulnerability due to observable timing discrepancy CWE-208. Fsas Technologies Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/...

PT-2024-37449 · Zohocorp · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 Description: The issue is related to SQL Injection in the reports module of the software. This allows for potential exploitation. No information is provided about the estimated...

ZOHO ManageEngine Exchange Reporter Plus SQL注入漏洞

ZOHO ManageEngine Exchange Reporter Plus is a Web-based Exchange Server reporting software from ZOHO, Inc. A SQL injection vulnerability exists in ZOHO ManageEngine Exchange Reporter Plus versions prior to 5715, which stems from susceptibility to SQL injection attacks...

CVE-2024-6204: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module...

Vietnamese Human Rights Group Targeted in Multi-Year Cyberattack by APT32

A non-profit supporting Vietnamese human rights has been the target of a multi-year campaign designed to deliver a variety of malware on compromised hosts. Cybersecurity company Huntress attributed the activity to a threat cluster tracked as APT32, a Vietnamese-aligned hacking crew that's also...

CISA Urges Federal Agencies to Patch Versa Director Vulnerability by September

The U.S. Cybersecurity and Infrastructure Security Agency CISA has placed a security flaw impacting Versa Director to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation. The medium-severity vulnerability, tracked as CVE-2024-39717 CVSS score: 6.6, is case of...

GO-2022-0914 Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc...

CVE-2024-39804

creationtimestamp| type| source ---|---|--- 2024-08-21 12:30:05+00:00| seen| https://t.me/truesecator/6115 2024-12-18 22:38:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113676225005041941 2024-12-19 01:25:08+00:00| seen| https://t.me/cvedetector/13279 2026-07-26 02:02:06+00:00| see...

CVE-2024-41138

creationtimestamp| type| source ---|---|--- 2024-08-21 12:30:05+00:00| seen| https://t.me/truesecator/6115 2024-12-18 22:38:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113676225019133745 2024-12-19 01:25:09+00:00| seen| https://t.me/cvedetector/13280 2025-09-15 13:28:32+00:00| see...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2021-33044link is external Dahua IP Camera Authentication Bypass Vulnerability CVE-2021-33045link is external Dahua IP Camera Authentication Bypass Vulnerability...

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution...

PT-2024-40864 · Libssh2 · Libssh2

Name of the Vulnerable Software and Affected Versions: libssh2 affected versions not specified Description: The issue is related to a heap-double-free crash. Technical details about the crash include the libssh2 default free function, diffie hellman sha algo, and kex method diffie hellman group14...

The vulnerability of the Reports module of the monitoring, analysis, and reporting software ManageEngine Exchange Reporter Plus allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the Reports module in the ManageEngine Exchange Reporter Plus software for monitoring, analysis, and report generation is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL...