Command injection

BeyondTrust Privileged Remote Access PRA and Remote Support RS versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute...

CVE-2023-4634

creationtimestamp| type| source ---|---|--- 2023-09-05 11:57:15+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5085 2023-09-06 09:31:08+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/7744 2023-09-06 12:17:47+00:00| seen| https://t.me/cibsecurity/69963 2023-09-07...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. Attackers have exploited the vulnerability to cause a denial-of-service attack on the system...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. Attackers have exploited the vulnerability to cause a denial-of-service attack on the system...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. Attackers have exploited the vulnerability to cause a denial-of-service attack on the system...

Qualys Top 20 Most Exploited Vulnerabilities

The earlier blog posts showcased an overview of the vulnerability threat landscape that is either remotely exploited or most targeted by attackers. A quick recap – We focused on high-risk vulnerabilities that can be remotely exploited with or without authentication, and with the view on the time ...

CISA Known Exploited Vulnerability Catalog August 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

CVE-2023-41642

creationtimestamp| type| source ---|---|--- 2023-08-31 18:13:03+00:00| seen| https://t.me/cibsecurity/69546 2023-10-11 03:19:16+00:00| published-proof-of-concept| https://t.me/codeb0ss/1231 2023-10-22 22:26:28+00:00| published-proof-of-concept| Telegram/7a7fweCj36f2cd-3XHNsj84vMqrUUzQeix11cFhtTPw...

CVE-2023-4584

The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes...

TP-LINK Smart bulb Tapo series L530 and Tapo Application Information Disclosure Vulnerability

TP-LINK Smart bulb Tapo is a smart bulb from China P&L TP-LINK. An information disclosure vulnerability exists in the TP-LINK Smart bulb Tapo series L530 and Tapo Application, which can be exploited by an attacker to obtain sensitive information via the IV component of the AES128-CBC feature...

CVE-2023-41109

creationtimestamp| type| source ---|---|--- 2023-08-29 00:16:59+00:00| seen| https://t.me/cibsecurity/69322 2023-12-31 00:20:25+00:00| seen| https://t.me/arpsyndicate/2263 2023-12-31 04:03:09+00:00| seen| https://t.me/arpsyndicate/2291 2025-01-31 00:00:00+00:00| seen| The Shadowserver...

Remote Command Execution Vulnerability in NC Cloud of UFIDA Network Technology Co.

NC Cloud is a large-scale enterprise digital platform that deeply applies new-generation digital intelligence technology and is completely based on cloud-native architecture to create an open, interconnected, converged and intelligent integrated cloud platform. A remote command execution...

Thousands of Unpatched Openfire XMPP Servers Still Exposed to High-Severity Flaw

Thousands of Openfire XMPP servers are unpatched against a recently disclosed high-severity flaw and are susceptible to a new exploit, according to a new report from VulnCheck. Tracked as CVE-2023-32315 CVSS score: 7.5, the vulnerability relates to a path traversal vulnerability in Openfire's...

WinRAR < 6.23 RCE

The remote host is running WinRAR, an archive manager for Windows. The version of WinRAR installed on the remote host is affected by a an improper validation of user-supplied data, which can result in memory access past the end of an allocated buffer which can be exploited remotely and may allow...

The Tale of Two Exploits - Breaking Down CVE-2023-36884 and the Infection Chain

The Tale of Two Exploits - Breaking Down CVE-2023-36884 and the Infection Chain By Chintan Shah · August 24, 2023 Executive Summary On July 11 2023, Microsoft released a patch fixing multiple actively exploited RCE vulnerabilities and disclosed a phishing campaign conducted by the threat actor,...

New Akira Ransomware Targets Businesses via Exploited CISCO VPNs

By Deeba Ahmed Akira ransomware operators specialize in targeting corporate endpoints for stealing sensitive data. This is a post from HackRead.com Read the original post: New Akira Ransomware Targets Businesses via Exploited CISCO VPNs...

CVE-2023-38831

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as the benign file, and the...

CVE-2023-39026

creationtimestamp| type| source ---|---|--- 2023-08-23 02:12:01+00:00| seen| https://t.me/cibsecurity/69043 2023-10-23 19:27:06+00:00| published-proof-of-concept| Telegram/X8AxNFp0HQTngPQfgKr7iAFqHeL4fj8-bjEOb-q8Rk 2023-10-24 15:05:53+00:00| published-proof-of-concept| https://t.me/CNArsenal/1351...

Ivanti Warns of Critical Zero-Day Flaw Being Actively Exploited in Sentry Software

Software services provider Ivanti is warning of a new critical zero-day flaw impacting Ivanti Sentry formerly MobileIron Sentry that it said is being actively exploited in the wild, marking an escalation of its security woes. Tracked as CVE-2023-38035 CVSS score: 9.8, the issue has been described...

Critical Adobe ColdFusion Flaw Added to CISA's Exploited Vulnerability Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a critical security flaw in Adobe ColdFusion to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability, cataloged as CVE-2023-26359 CVSS score: 9.8, relates to a...