Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco, U.S. A cross-site request forgery vulnerability exists in Cisco SD-WAN vManage Software, which can be exploited by attackers to perform arbitrary actions at the affected user...

Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches拒绝服务漏洞

Cisco Catalyst Digital Building Series Switches is a series of digital building switches from Cisco, U.S. Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches have a denial of service vulnerability that can be exploited by an attacker to cause a permanent denial of...

QNAP QTS / QuTS hero Command Injection (QSA-21-05)

The version of QNAP QTS or QuTS hero on the remote host is affected by a command injection vulnerability. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. Note that Nessus has not tested for this issue but has instead relied only on the...

CScms SQL Injection Vulnerability (CNVD-2022-33152)

CScms is a content management system CMS developed based on the CI framework. cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers via the component danceLists.phpzhuan...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-42139)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android has an elevation of privilege vulnerability, which stems from incorrectly entered authentication and can be exploited by attackers to cause a local privilege escalation...

Two actively exploited vulnerabilities affect multiple VMware products

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Multiple vulnerabilities have been discovered in VMware products. Two of these have been exploited in the wild. The first zero-day vulnerability, CVE-2022-22954, is a server-side template injection flaw. An attacker could...

Latest Update for Google Chrome Fixes Actively Exploited 0-day Flaw

By Waqas One of the two security vulnerabilities identified in the Google Chrome web browser was reportedly being actively exploited… This is a post from HackRead.com Read the original post: Latest Update for Google Chrome Fixes Actively Exploited 0-day Flaw...

SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2022-33129)

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces. SAP 3D Visual Enterprise Viewer version 9.0 is...

Cisco IOS XR SNMP Denial of Service Vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.Cisco IOS XE has a denial of service vulnerability that stems from an SNMP trap that causes a fatal error in Cisco IOS XE, which can be exploited by attackers to trigger a denial of service...

Dell PowerScale OneFS Denial of Service Vulnerability (CNVD-2022-32824)

Dell PowerScale OneFS is a PowerScale OneFS operating system that provides scale-out NAS. Dell PowerScale OneFS has a security vulnerability that could be exploited by an attacker to cause a denial of service...

Microsoft Windows Secure Channel Denial of Service Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A denial of service vulnerability exists in Microsoft Windows Secure Channel. The vulnerability stems from a failure to properly handle incoming error messages and can be exploited by ...

Microsoft Windows Hyper-V Remote Code Execution Vulnerability (CNVD-2022-74595)

Microsoft Windows Hyper-V is a tool from Microsoft Corporation that provides hardware virtualization. Microsoft Windows Hyper-V is vulnerable to a remote code execution vulnerability that could be exploited by attackers to execute arbitrary code on the system...

Microsoft Windows Kerberos Remote Code Execution Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A remote code execution vulnerability exists in Microsoft Windows Kerberos. The vulnerability stems from failure to properly process input data and can be exploited by an attacker to...

SAP NetWeaver Application Server权限提升漏洞

SAP NetWeaver Application Server is an application server from SAP Germany. SAP NetWeaver Application Server elevation of privilege vulnerability, which stems from a lack of authentication checks in the XML data archiving service, can be exploited by an attacker to cause an elevation of privilege...

CISA Adds Nine Known Exploited Vulnerabilities to Catalog

CISA has added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly add...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2022-71765)

Microsoft HEVC Video Extensions is a video extension application from Microsoft USA. The application enables computers and devices to read High Efficiency Video Coding or HEVC videos. A remote code execution vulnerability exists in Microsoft HEVC Video Extensions, which can be exploited by an...

CSZ CMS SQL Injection Vulnerability (CNVD-2022-30780)

CSZ CMS is a PHP-based open source content management system CMS. cszcmsadminMembersviewUsers version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of externally entered SQL statements and can be exploited by attackers to execute illegal SQL commands t...

CSZ CMS SQL Injection Vulnerability (CNVD-2022-30779)

CSZ CMS is a PHP-based open source content management system CMS. CSZ CMS version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in cszcmsadminPluginmanagersetstatus, and can be exploited by attackers to execute illegal...

Movie Seat Reservation System SQL Injection Vulnerability

Movie Seat Reservation System is a seat reservation system from an individual developer.Movie Seat Reservation System is vulnerable to SQL injection, which can be exploited by attackers to execute malicious SQL commands...