CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Vmware Spring Framework Denial of Service Vulnerability

Vmware Spring Framework is a set of open source Java, JavaEE application framework from Vmware USA. The framework helps developers build high-quality applications.Vmware Spring Framework has a denial-of-service vulnerability that can be exploited by attackers to cause a denial of service via a...

CVE-2022-22274

creationtimestamp| type| source ---|---|--- 2022-03-29 11:35:50+00:00| seen| https://t.me/truesecator/2781 2022-03-29 12:52:24+00:00| seen| https://t.me/informationsecuritychannel/46999 2023-01-15 14:05:50+00:00| published-proof-of-concept| https://t.me/crackcodes/2272 2024-01-16 10:54:08+00:00|...

NETGEAR R8500 Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from the American company Netgear. A security vulnerability exists in the NETGEAR R8500, which can be exploited by an attacker to execute arbitrary commands e.g. telnetd via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters of...

Directory traversal

An Archive Extraction AKA "Zip Slip vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal...

Analyzing the Attack Landscape: Rapid7’s 2021 Vulnerability Intelligence Report

Every year, our research team at Rapid7 analyzes thousands of vulnerabilities to understand root causes, dispel misconceptions, and explain why some flaws are more likely to be exploited than others. By continuously reviewing the vulnerability landscape and sharing our research team’s insights, w...

CISA Adds 32 Known Exploited Vulnerabilities to Catalog

CISA has added 32 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

Covid-19 Directory On Vaccination System 1.0 SQL Injection

Exploit Title: Covid-19 Directory on Vaccination System 1.0 - SQLi Authentication Bypass Date: 28/03/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2021-44462

This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures...

CISA Adds 66 Known Exploited Vulnerabilities to Catalog

CISA has added 66 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

D-Link DIR-816 A2 Command Injection Vulnerability

D-Link DIR-816 A2 is a wireless router from D-Link, Taiwan, China. D-Link DIR-816 A2 1.10 B05 is vulnerable to command injection, which can be exploited by attackers to arbitrarily reset the device to /goform/form2Reboot.cgi via the crafted tokenid parameter...

CVE-2020-20093

creationtimestamp| type| source ---|---|--- 2022-03-24 01:29:14+00:00| seen| https://t.me/cibsecurity/39473 2022-03-26 16:50:20+00:00| published-proof-of-concept| https://t.me/cKure/9181 2022-03-28 17:01:00+00:00| exploited| https://t.me/truesecator/2779 2022-03-28 19:02:41+00:00| exploited|...

CVE-2020-20094

creationtimestamp| type| source ---|---|--- 2022-03-24 01:29:07+00:00| seen| https://t.me/cibsecurity/39468 2022-03-28 17:01:00+00:00| exploited| https://t.me/truesecator/2779 2022-03-28 19:02:41+00:00| exploited| https://t.me/SEReborn/2017 2022-03-29 11:01:01+00:00| published-proof-of-concept|...

CVE-2020-20095

creationtimestamp| type| source ---|---|--- 2022-03-24 01:28:57+00:00| seen| https://t.me/cibsecurity/39462 2022-03-28 17:01:00+00:00| exploited| https://t.me/truesecator/2779 2022-03-28 19:02:41+00:00| exploited| https://t.me/SEReborn/2017 2022-03-29 11:01:01+00:00| published-proof-of-concept|...

ImpressCMS SQL Injection Vulnerability (CNVD-2022-30802)

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to a SQL injection vulnerability that stems from insufficient cleaning of user data passed in the groupps parameter of the...

HexoEditor Cross-Site Scripting Vulnerability (CNVD-2022-25206)

HexoEditor is an open source Markdown a markup language that can be written using a normal text editor editor optimized for Hexo a blogging framework. HexoEditor 1.1.8 contains a cross-site scripting vulnerability that can be exploited to place a common cross-site scripting payload into a...

CVE-2022-22620

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 v. 16612.4.9.1.8 and 15612.4.9.1.8. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a...

CVE-2022-22587

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may...