Log4j’s Log4Shell Vulnerability: One Year Later, It’s Still Lurking

Despite mitigation, one of the worst bugs in internet history is still prevalent—and being exploited...

CVE-2022-38754

A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM Operations Bridge Manager user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is on...

Apache Solr 7.4.0 <= 7.7.3 / 8.0.0 <= 8.11.0 RCE

The version of Apache Solr running on the remote host is at least 7.4.0 through 7.7.3 or 8.0.0 through 8.11.0. It is, therefore, affected by a remote code execution vulnerability due to using a bundled version of the Apache Log4J library vulnerable to RCE. For full impact and additional detail...

CVE-2022-45359

creationtimestamp| type| source ---|---|--- 2022-12-07 00:41:00+00:00| seen| https://t.me/cibsecurity/54101 2022-12-26 17:22:22+00:00| exploited| https://t.me/truesecator/3878 2022-12-27 09:24:08+00:00| exploited| https://t.me/SecLabNews/13177 2023-02-01 02:23:19+00:00| published-proof-of-concept...

CVE-2022-46169

creationtimestamp| type| source ---|---|--- 2022-12-06 00:40:20+00:00| seen| https://t.me/cibsecurity/54031 2022-12-07 07:17:18+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3568 2022-12-07 11:01:06+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/7314...

WordPress plugin Contest Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Oracle Linux 7 : libvirt (ELSA-2022-10062)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-10062 advisory. - security: fix SELinux label generation logic Daniel P. Berrange Orabug: 34773029 CVE-2021-3631 Tenable has extracted the preceding description block directly...

App Flaw Allowed Honda and Nissan Cars Hack by Knowing VIN number

By Habiba Rashid According to white hat hacker Sam Curry, once exploited, attackers could use the flaw to unlock the door, honk the horn, flash the lights, or even start the vehicle. This is a post from HackRead.com Read the original post: App Flaw Allowed Honda and Nissan Cars Hack by Knowing VI...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. This type of vulnerability is a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: To view the newly added...

CVE-2022-25765

creationtimestamp| type| source ---|---|--- 2022-12-04 21:05:25+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3527 2022-12-06 04:04:20+00:00| published-proof-of-concept| https://t.me/crackcodes/1638 2022-12-06 06:38:55+00:00| published-proof-of-concept| https://t.me/simosaper/748...

Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability

Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser. The high-severity flaw, tracked as CVE-2022-4262, concerns a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis...

Google Chrome < 108.0.5359.94 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 108.0.5359.94. It is, therefore, affected by a vulnerability as referenced in the 202212stable-channel-update-for-desktop advisory. - Type Confusion in V8. CVE-2022-4262 Note that Nessus has not tested for this issue bu...

Google Chrome < 108.0.5359.94 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 108.0.5359.94. It is, therefore, affected by a vulnerability as referenced in the 202212stable-channel-update-for-desktop advisory. - Type Confusion in V8. CVE-2022-4262 Note that Nessus has not tested for this issue but...

CVE-2022-3696

creationtimestamp| type| source ---|---|--- 2022-12-01 20:36:49+00:00| seen| https://t.me/cibsecurity/53771 2022-12-07 10:30:06+00:00| exploited| https://t.me/truesecator/3794...

CVE-2022-45045

creationtimestamp| type| source ---|---|--- 2022-12-01 07:30:40+00:00| exploited| https://t.me/cibsecurity/53750 2026-06-19 12:47:01+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c126a7e1-74dc-4b78-8c8c-0d6d64e7919b...

QEMU Buffer Overflow Vulnerability (CNVD-2022-84156)

QEMU Quick Emulator is a set of emulation processor software by Fabrice Bellard, a French personal developer. The software is fast and cross-platform. QEMU suffers from a buffer overflow vulnerability that stems from a lack of validation of the input data size or length in the readerstrecord and...

Chocolatey PHP Permission Design Vulnerability

PHP is a scripting language that executes on the server side. A privilege design vulnerability exists in the Chocolatey PHP package v8.1.12 and below, which originates from all users in the Authenticated users group having write access to the subfolder C:\tools\php81 and all files in that folder,...

KLiK SocialMediaWebsite reply-form cross-site scripting vulnerability

KLiK SocialMediaWebsite is a simple PHP based social media website by Muhammad Saad personal developer. A cross-site scripting vulnerability exists in KLiK SocialMediaWebsite version 1.0.1 at reply-form. The vulnerability stems from a lack of effective filtering and escaping of user-supplied data...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

Google Chrome Live Caption Code Execution Vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome Live Caption, which can be exploited by attackers to execute arbitrary code on a system or cause a denial of service...