Wedding Hall Booking System 跨站脚本漏洞

Wedding Hall Booking System is a simple PHP-titled wedding hall booking system by the individual developer Carlo Montero. A cross-site scripting vulnerability exists in SourceCodester Wedding Hall Booking System, which stems from an unknown portion of the Staff User Profile code in its...

CVE-2022-31793

dorequest in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and...

CVE-2022-34967

The assertion stmt-Dbc-FirstStmt' failed in MonetDB Database Server v11.43.13...

[SECURITY] Fedora 36 Update: ignition-2.14.0-3.fc36

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regular files, systemd units, etc., and configuring users. On first boot, Ignition reads its configuration from a source of truth remote URL, network...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

多款AMD处理器安全漏洞

AMD Processors is a processor from the American company AMD. A security vulnerability exists in AMD CPU Branch. The following products and versions are affected: AMD Athlon™ X4 processor,AMD Ryzen™ Threadripper™ PRO processor,2nd Gen AMD Ryzen™ Threadripper™ processors,3rd Gen AMD Ryzen™...

The vulnerability of the OSPF network protocol implementation in the microcomputer-based switching devices SCALANCE of the XM-400 and XR-500 series allows a intruder to trigger a service failure.

The vulnerability of the OSPF network protocol implementation in the microcomputer-based switching devices SCALANCE models XM-400 and XR-500 is related to the lack of integrity checks. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

CVE-2022-2279

creationtimestamp| type| source ---|---|--- 2022-07-01 12:39:29+00:00| seen| https://t.me/cibsecurity/45464...

The vulnerability of the first-stage bootloader in ESP32 microcontrollers’ microprogramming software allows a hacker to obtain secure boot keys.

The vulnerability of the first-stage Secure Boot loader of ESP32 microcontrollers’ microprogramming software is related to insufficient handling of exceptional states. Exploiting this vulnerability can allow attackers to obtain secure boot keys...

Conti vs. LockBit: A Comparative Analysis of Ransomware Groups

We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022...

Interpol’s First Light operation smashes crime on a global scale

A large-scale Interpol operation has resulted in arrested and ill-gotten gains seizures galore. Operation First Light took place between March and May of this year. It involved 76 countries taking social engineers and telecommunications fraudsters to task, with multiple wins for those involved...

CVE-2021-37182

A vulnerability has been identified in SCALANCE XM408-4C All versions V6.5, SCALANCE XM408-4C L3 int. All versions V6.5, SCALANCE XM408-8C All versions V6.5, SCALANCE XM408-8C L3 int. All versions V6.5, SCALANCE XM416-4C All versions V6.5, SCALANCE XM416-4C L3 int. All versions V6.5, SCALANCE...

Siemens SCALANCE 安全漏洞

SCALANCE X switches are used to connect industrial components such as programmable logic controllers PLCs or human machine interfaces HMIs. An OSPF packet handling vulnerability exists in the SIEMENS SCALANCE XM-400 and XR-500, which stems from the implementation of the OSPF protocol in the devic...

Bribe Rewards Struck In Contract If Deposited During First Epoch

Lines of code Vulnerability details Vulnerability Details Bribe rewards added to the Bribe contract in the first epoch will not be claimable by any voters, and the rewards will struck in the Bribe contract. Proof-of-Concept Assume that the current epoch is epoch 0, and start date of epoch 0 is Da...

BathToken.sol A malicious early user/attacker can manipulate the vault's pricePerShare to take an unfair share of future users' deposits

Lines of code Vulnerability details function deposituint256 assets, address receiver internal returns uint256 shares uint256 pool = underlyingBalance; uint256 before = underlyingToken.balanceOfaddressthis; // Assume caller is depositor underlyingToken.transferFrommsg.sender, addressthis, assets;...

CVE-2022-30494: Improper Neutralization of Input During Web Page Generation

In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs...

GHSA-Q693-V7QF-P4XJ Alkacon OpenCMS CSV Injection via New User module

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

Water-billing-management-system 跨站脚本漏洞

Water-billing-management-system is a water billing management system by Carlo Montero Personal Developer. A security vulnerability exists in Water-billing-management-system version 1.0, which originates from a /wbms/classes/Users.php?f=save, firstname stored cross-site scripting XSS attack...

CVE-2022-29005

Multiple cross-site scripting XSS vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters...