How the CISA catalog of vulnerabilities can help your organization

The Cybersecurity and Infrastructure Security Agency CISA maintains a "known exploited vulnerabilities catalog" which can be useful if you need help prioritizing the patching of vulnerabilities. In essence it is a long list of vulnerabilities that are actually being used by criminals to do harm,...

CVE-2023-25135

creationtimestamp| type| source ---|---|--- 2023-02-03 07:25:33+00:00| seen| https://t.me/cibsecurity/57440 2023-02-04 17:08:41+00:00| published-proof-of-concept| Telegram/AqbQcSruHnWkutfE8evxRkyLJKRGDqBk7h61RFWxZdE1Lg 2023-02-04 18:01:24+00:00| published-proof-of-concept|...

CVE-2022-46604

creationtimestamp| type| source ---|---|--- 2023-02-02 16:14:49+00:00| seen| https://t.me/cibsecurity/57393 2023-04-05 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/51251 2023-04-10 10:59:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8091 2023-04-29...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Note: To view the newly adde...

CVE-2022-46552

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution RCE vulnerability via the lan0dhcpsstaticlist parameter. This vulnerability is exploited via a crafted POST request...

WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection

Software Posts and Users Stats Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-44738 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID adb9c8d12136 Credits Mika Required privilege Subscriber Publishe...

Can't Wait to Shut You Down — Remote DoS Using Wininit.exe

Akamai researchers explore a new vulnerability that can be exploited to lead to denial-of-service attacks against Windows machines...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17073)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause arbitrary command execution via specially crafted network packets...

Adobe Acrobat and Reader Out-of-Bounds Read Vulnerability (CNVD-2023-51689)

Adobe Acrobat Reader is the United States of America Audobee Adobe, a PDF viewer. An out-of-bounds read vulnerability exists in Adobe Acrobat and Reader, which can be exploited by an attacker to cause a sensitive memory leak...

Adobe Acrobat and Reader Buffer Overflow Vulnerability (CNVD-2023-51685)

Adobe Acrobat Reader is the United States of America Audobee Adobe, a PDF viewer. A buffer overflow vulnerability exists in Adobe Acrobat and Reader, which can be exploited by an attacker to execute arbitrary code in the context of the current user...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17085)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to cause arbitrary command execution by sending a specially crafted network packet...

Nexus PHP Cross-Site Scripting Vulnerability (CNVD-2023-05398)

NexusPHP is a free and open source complete solution for building PT websites. NexusPHP has a security vulnerability that can be exploited by attackers to permanently inject arbitrary web scripts or HTML via the title parameter used in /subtitles.php...

A Malicious User can Lock All Funds in an Option

Lines of code Vulnerability details Impact By calling the mint and burn functions with the 'amount0' and 'amount1' equal to the the option pair's respective balances of token0 and token1, a user can cause a given option's "Option.totalLong0" and "Option.totalLong1" to both be set to 0. The effect...

Mozilla: libusrsctp library out of date

The Mozilla Foundation Security Advisory describes this flaw as: An out of date library libusrsctp contained vulnerabilities that could potentially be exploited...

CISA Has Added One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. This type of vulnerability is a frequent attack vector for malicious cyber actors and poses a significant risk to the federal enterprise. Note: To view the newly added...

Weak Password Vulnerability in Moxa NPort Web Console

Moxa develops and manufactures information networking products, providing customers with cost-effective and stable serial communication solutions, serial device networking solutions, and industrial Ethernet solutions. A weak password vulnerability exists in the Moxa NPort Web Console, which can b...

Mozilla: libusrsctp library out of date

The Mozilla Foundation Security Advisory describes this flaw as: An out of date library libusrsctp contained vulnerabilities that could potentially be exploited...

Apple Issues Updates for Older Devices to Fix Actively Exploited Vulnerability

Apple has backported fixes for a recently disclosed critical security flaw affecting older devices, citing evidence of active exploitation. The issue, tracked as CVE-2022-42856, is a type confusion vulnerability in the WebKit browser engine that could result in arbitrary code execution when...

Mozilla: libusrsctp library out of date

The Mozilla Foundation Security Advisory describes this flaw as: An out of date library libusrsctp contained vulnerabilities that could potentially be exploited...

Mozilla: libusrsctp library out of date

The Mozilla Foundation Security Advisory describes this flaw as: An out of date library libusrsctp contained vulnerabilities that could potentially be exploited...