CVE-2022-26245

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...

Sql injection

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...

CVE-2022-26245

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...

CVE-2022-26245

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...

CVE-2022-26245

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...

CVE-2022-26245

Falcon-plus v0.3 contains a SQL injection in the grpName parameter of /config/service/host.go. The CVE entry CVE-2022-26245 is described consistently across sources, with high/critical impact (CVSS v3.1: 9.8) and network attack vector with no authentication; impact includes confidentiality, integ...

Falcon SQL Injection Vulnerability

Falcon is an embedded programming language. An SQL injection vulnerability exists in Falcon-plus v0.3, which originates from the grpName parameter in /config/service/host.go. An attacker could exploit this vulnerability to cause SQL injection...

PT-2022-17738

Name of the Vulnerable Software and Affected Versions Falcon-plus version 0.3 Description A SQL injection issue was discovered in Falcon-plus, affecting the "grpName" parameter in the "/config/service/host.go" endpoint. This allows for potential SQL injection attacks via the grpName parameter...

CVE-2022-26245: Improper Neutralization of Special Elements used in an SQL Command

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...

Guidance for CVE-2022-23278 spoofing in Microsoft Defender for Endpoint

Microsoft released a security update to address CVE-2022-23278 in Microsoft Defender for Endpoint. This important class spoofing vulnerability impacts all platforms. We wish to thank Falcon Force for the collaboration on addressing this issue through coordinated vulnerability disclosure...

New Wave of Cyber Attacks Target Palestine with Political Bait and Malware

Cybersecurity researchers have turned the spotlight on a new wave of offensive cyberattacks targeting Palestinian activists and entities starting around October 2021 using politically-themed phishing emails and decoy documents. The intrusions are part of what Cisco Talos calls a longstanding...

APT ‘Aquatic Panda’ Targets Universities with Log4Shell Exploit Tools

Cyber criminals, under the moniker Aquatic Panda, are the latest advanced persistent threat group APT to exploit the Log4Shell vulnerability. Researchers from CrowdStrike Falcon OverWatch recently disrupted the threat actors using Log4Shell exploit tools on a vulnerable VMware installation during...

File Upload Vulnerability in Terminal Security System of Beijing Falcon Security Technology Co.

Terminal Security System V9.0 is a terminal security management platform specially designed for the government, military industry, energy, education, medical care and grouped enterprises. There is a file uploading vulnerability in the Terminal Security System of Beijing Falcon Security Technology...

OS Command Injection in falconchristmas/fpp

✍️ Description Hi, it is possible ot inject arbitrary OS commands in https://github.com/FalconChristmas/fpp/blob/f032d800a67ed280f8d577d95519a71c95114579/www/upgradeOS.phpL46 php system$SUDO . " $fppDir/SD/upgradeOS-part1.sh /home/fpp/media/upload/" . $GET'os'; 🕵️‍♂️ Proof of Concept Visit :...

Intel Falcon 8+ UAS AscTec Thermal Viewer Privilege Escalation

The vulnerability of Intel Falcon 8+ UAS AscTec Thermal Viewer relates to errors during resolution saving. Exploiting this vulnerability can allow attackers to enhance their privileges...

OS Command Injection in falconchristmas/fpp

✍️ Description FPP - Falcon Player is vulnerable to OS Command injection attacks on ping.php because it doesnt sanitize user supplied parameters as shown below. : Vulnerable variable: count Method: GET The $count variable is constructed using the user supplied data, and then is used in a system...

V8+ Terminal Security System of Beijing Falcon Security Technology Co., Ltd. has Arbitrary File Download Vulnerability

V8+ Terminal Security System is a new-generation enterprise terminal security software, which can dynamically detect, real-time process, and trace unknown threats in the user's network across the network to meet the increasingly complex needs of domestic enterprise users for security protection o...

Beijing Falcon Security Technology Co., Ltd Terminal Security System 9.0 has Arbitrary File Download Vulnerability

Terminal Security System V9.0 is a terminal security management platform specially designed for the government, military industry, energy, education, medical treatment and grouped enterprises. Beijing Falcon Security Technology Co., Ltd Terminal Security System 9.0 has an arbitrary file download...

Falcon Terminal Security System V9.0 suffers from local elevation of privilege vulnerability

The business scope of Beijing Falcon Security Technology Co., Ltd. includes: technology promotion, technology development, technology service, technology consulting; sales of computers, software and auxiliary equipment, electronic products and so on. Falcon Terminal Security System V9.0 has a loc...

Major BEC Phishing Ring Cracked Open with 3 Arrests

Three men suspected of participating in a massive business email compromise BEC ring have been arrested in Lagos, Nigeria. A joint INTERPOL, Group-IB and Nigeria Police Force cybercrime investigation resulted in the arrest of the Nigerian nationals, believed to be responsible for distributing...