3674 matches found
CVE-2022-41765
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidden users...
Automatically discover and secure your APIs with Wiz Dynamic Scanner
Wiz enhances its Dynamic Scanner to detect publicly exposed, unauthenticated APIs...
Unauthenticated Remote Command Execution on corebos due to exposed install files.
Description While analysing corebos source-code, I found a file that looked interesting: - install/MigrationDbBackup.php This file contains the following snippet of code: php ?php /+ The contents of this file are subject to the vtiger CRM Public License Version 1.0 "License"; You may not use this...
CVE-2022-46685
In Jenkins Gitea Plugin, versions 1.4.4 and earlier did not mask Gitea personal access tokens, potentially exposing credentials in build logs. The issue is documented across multiple feeds (NVD, Red Hat, OSV, GHSA) with the same root cause and scope: credentials masking was not supported, enablin...
CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
8x8: Unprotected Atlantis Server at https://152.70.█.█
Atlantis is an application for automating Terraform via pull requests. @shuvam321 reported to us an exposed Atlantis test server in our infrastructure. No sensitive information had been disclosed & we restricted access to the Atlantis service entirely, which resolved the issue...
PT-2022-5775 · NetGear · Netgear Rax30 Ax2400
Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 AX2400 series of routers versions prior to 1.0.9.90 Description: A network misconfiguration is present in the affected devices, where IPv6 is enabled for the WAN interface by default. However, the firewall restrictions in place...
PT-2022-26174 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.12 Discourse versions prior to 2.9.0.beta13 Description: Discourse is an open-source discussion platform. Under certain conditions, a user can see notifications for topics they no longer have access to,...
CVE-2022-4136
Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...
UBUNTU-CVE-2022-45149
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a...
Design/Logic Flaw
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server...
The DTrack Backdoor campaigns aimed European organizations
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary DTrack, a malware developed by the Lazarus group is a flexible backdoor that unloads malware in stages. It is dispersed with filenames that are routinely used in legitimate executables. The backdoor is...
CVE-2022-43999
An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server...
CVE-2022-44000
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server...
PT-2022-5451 · Microsoft · Windows Network Policy Server +1
Name of the Vulnerable Software and Affected Versions: Windows Network Policy Server NPS affected versions not specified Description: The issue is related to insufficient protection of service data in the Network Policy Server NPS of Windows operating systems. This can allow a remote attacker to...
Leaked Amazon Prime Video Server Exposed Users Viewing Habits
By Waqas Security researcher Anurag Sen revealed Amazon failed to protect one of its internal servers, which allowed any third party to access the database. This is a post from HackRead.com Read the original post: Leaked Amazon Prime Video Server Exposed Users Viewing Habits...
PDFium Component PDFium Data Compromise
The vulnerability of the PDFium component in the Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through a specially created...
CVE-2022-39329
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database acces...
167,000 stolen credit card numbers Exposed via PoS Malware
By Waqas The campaign was discovered in April 2022, but researchers believe the campaign occurred between February 2021 and September 8, 2022. This is a post from HackRead.com Read the original post: 167,000 stolen credit card numbers Exposed via PoS Malware...