CVE-2021-25989 ifme - Stored Cross-Site Scripting (XSS) in Groups section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them...

Garrett Metal Detectors Path Traversal Vulnerability (CNVD-2022-01318)

Garrett Metal Detectors is a walk-in metal detector from Garrett, U.S.A. Garrett Metal Detectors is vulnerable to a path traversal vulnerability that could be exploited to delete arbitrary files...

Lantronix PremierWave 2050 Buffer Overflow Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 version 8.9.0.0R4 is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to send specially designed HTTP requests for arbitrary command...

Garrett Metal Detectors Buffer Overflow Vulnerability (CNVD-2022-01316)

Garrett Metal Detectors is a walk-in metal detector from Garrett, U.S.A. Garrett Metal Detectors is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a stack buffer overflow...

Avast Antivirus Elevation of Privilege Vulnerability

Avast antivirus, a suite of antivirus software from the Czech company Avast, has an elevation of privilege vulnerability that could be exploited by a local attacker to gain elevated privileges by invoking non-essential powerful internal methods of the main antivirus service...

Google Android Log Information Disclosure Vulnerability (CNVD-2021-103433)

Google Android is a Linux-based open source operating system from Google, Inc. A log information disclosure vulnerability exists in Google Android, which can be exploited by attackers to disclose local information that requires system execution privileges...

4-Year-Old Microsoft Azure Zero-Day Exposes Web App Source Code

The Microsoft Azure App Service has a four-year-old vulnerability that could reveal the source code of web apps written in PHP, Python, Ruby or Node, researchers said, that were deployed using Local Git. The bug has almost certainly been exploited in the wild as a zero-day, according to an analys...

Dalmark Systems Systeam Security Vulnerability

Dalmark Systems Systeam is an Erp system from Dalmark Systems, a Brazilian company. version 2.22.8 build 1724 of Dalmark Systems Systeam contains a security vulnerability that could be exploited by an attacker to brute-force a valid user...

Apache Tika 2.x < 2.2.0 Log4j RCE Vulnerability (Log4Shell)

Apache Tika is prone to a remote code execution RCE vulnerability in the Apache Log4j library dubbed SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

OPMS Cross-site Request Forgery Vulnerability

OPMS is an OA management system. v1.3 and previous versions of OPMS contain a security vulnerability that can be exploited to add arbitrary user accounts via /user/add...

Fresenius Kabi Agilia Connect Infusion System has an unspecified vulnerability

Fresenius Kabi Agilia Connect Infusion System is an infusion system from the German company Fresenius Kabi.A security vulnerability exists in the Fresenius Kabi Agilia Connect Infusion System, which could be exploited by an attacker to emulate a user to manipulate RabbitMQ queues and messages...

mySCADA myPRO Authentication Bypass Vulnerability

mySCADA myPRO is an HMI/SCADA system designed primarily for the visualization and control of industrial processes. An authentication bypass vulnerability exists in mySCADA myPRO, which can be exploited by an attacker to access the application without any form of authentication or authorization...

Apache Archiva < 2.2.6 Multiple Log4j Vulnerabilities (Log4Shell) - Version Check

Apache Archiva is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Google Android Information Disclosure Vulnerability (CNVD-2021-101957)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android has an information disclosure vulnerability that can be exploited by attackers to cause local information disclosure without additional execution privileges...

CVE-2021-44790

creationtimestamp| type| source ---|---|--- 2021-12-20 14:39:58+00:00| seen| https://t.me/cibsecurity/34272 2021-12-23 17:49:44+00:00| seen| https://t.me/poxek/322 2021-12-28 16:00:47+00:00| seen| https://t.me/truesecator/2485 2022-01-25 20:42:22+00:00| published-proof-of-concept|...

Apache JSPWiki 2.11.0 Log4j RCE Vulnerability (Log4Shell) - Active Check

Apache JSPWiki is prone to a remote code execution RCE vulnerability in the Apache Log4j library dubbed SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2022-59689)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. Microsoft HEVC Video Extensions is a remote code execution vulnerability that can be exploited by attackers to execute arbitrary code on a system...

WordPress Temporary Login Without Password plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress Temporary Login Without Password plugin...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALAS-2021-001) (deprecated)

This plugin has been deprecated following detection of an issue with overlapping filenames. Deprecated by al2ALASCORRETTO8-2021-001.nasl plugin ID 160410 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory...

Threat Intelligence on Log4j CVE: Key Findings and Their Implications

Continuing with our research into CVE-2021-44228, Akamai has previously written about what the vulnerability is and given recommendations on how to go beyond patching for extra protection. Across the Akamai network, we see traffic from 1.3 billion unique devices daily, with record traffic of 182...