A zero-day vulnerability in Atlassian Confluence

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The Cybersecurity and Infrastructure Security Agency CISA has warned organizations about a new vulnerability in Atlassians Confluence Server and Data Center. This vulnerability is actively exploited in t...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2022-62757)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite 7.10.4 and prior...

School Dormitory Management System SQL Injection Vulnerability

School Dormitory Management System is a school dormitory management system. SQL injection vulnerability exists in School Dormitory Management System, which can be exploited by attackers to conduct SQL injection attacks...

Avantune Genialcloud ProJ Cross-Site Scripting Vulnerability

Avantune Genialcloud ProJ is a cloud-based ERP platform from Avantune Canada. version 10 of Avantune Genialcloud ProJ is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to inject and execute arbitrary web scripts or HTML via a crafted payload...

Illumina Local Run Manager File Upload Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager contains a file upload vulnerability that could be exploited by an attacker to upload any file typ...

Unspecified vulnerability in Carrier LenelS2 HID Mercury access panels (CNVD-2022-77061)

Carrier LenelS2 HID Mercury access panels is a controller panel from Carrier, U.S.A. A security vulnerability exists in Carrier LenelS2 HID Mercury access panels, which could be exploited by an attacker to send specially crafted network packets to remove a user from the web interface. user...

Atlassian Releases Patch for Confluence Zero-Day Flaw Exploited in the Wild

Atlassian on Friday rolled out fixes to address a critical security flaw affecting its Confluence Server and Data Center products that have come under active exploitation by threat actors to achieve remote code execution. Tracked as CVE-2022-26134, the issue is similar to CVE-2021-26084 — another...

An Actively Exploited Microsoft Zero-Day Flaw Still Has No Patch

The company continues to downplay the severity of the Follina vulnerability, which remains present in all supported versions of Windows...

Atlassian Releases New Versions of Confluence Server and Data Center to Address CVE-2022-26134

Atlassian has released new Confluence Server and Data Center versions to address remote code execution vulnerability CVE-2022-26134 affecting these products. An unauthenticated remote attacker could exploit this vulnerability to execute code remotely. Atlassian reports that there is known...

CISA Adds One Known Exploited Vulnerability (CVE-2022-26134) to Catalog  

CISA has added one new vulnerability—CVE-2022-26134—to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view t...

Clever — and Exploitable — Windows Zero-Day

Researchers have reported a still-unpatched Windows zero-day that is currently being exploited in the wild. Heres the advisory, which includes a work-around until a patch is available...

FAQ: Mitigating Microsoft Office’s ‘Follina’ zero-day

On Monday May 30, 2022, Microsoft issued CVE-2022-30190 for a zero-day remote code vulnerability, Follina, already being exploited in the wild via malicious Word documents. Q: What exactly is Follina? A: Follina is the nickname given to a new vulnerability discovered as a zero-day and identified ...

Microsoft Windows Support Diagnostic Tool (MSDT) RCE Vulnerability (Follina)

This host is missing a workaround for a critical security flaw in the Microsoft Windows Support Diagnostic Tool MSDT dubbed SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2022-31747

Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to...

WordPress Poll Maker plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. Cross-site scripting vulnerabilities exist in versions of the WordPress Poll Maker plugin prior t...

Command Execution Vulnerability in WoSmart Top Shop Mall System

Zhejiang WoSmith Information Technology Co., Ltd. is a technology company specializing in mobile Internet technology development. There is a command execution vulnerability in WoSmith's list store mall system, which can be exploited by an attacker to gain control of the server...

QNAP QuTS hero Privilege Escalation Vulnerability (QSA-22-05)

QNAP QuTS hero is prone to a local privilege escalation vulnerability, also known as dirty pipe. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

Horner Automation Cscape Csfont Out-of-Bounds Reading Vulnerability

Horner Automation Cscape is a programming software for industrial control system development from Horner Automation, Inc. An out-of-bounds read vulnerability exists in Horner Automation Cscape Csfont, which can be exploited by attackers to execute arbitrary code...

F-secure Atlant Denial of Service Vulnerability

F-secure Atlant is a platform from the Finnish company F-secure for building applications that can scan and detect malicious files. a denial-of-service vulnerability exists in F-Secure Atlant, which can be exploited by attackers to crash the scanning engine by scanning the aemobile component...

CVE-2019-6260

creationtimestamp| type| source ---|---|--- 2022-05-26 15:37:56+00:00| seen| https://t.me/informationsecuritychannel/47562 2022-05-27 17:30:04+00:00| exploited| https://t.me/truesecator/2990...