14499 matches found
KB5009545: Windows 10 Version 1909 Security Update (January 2022)
The remote Windows host is missing security update 5009545. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-21849, CVE-2022-21850,...
KB5009621: Windows 7 and Windows Server 2008 R2 Security Update (January 2022)
The remote Windows host is missing security update 5009621. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-21850, CVE-2022-21851,...
HTTP Commander 3.1.9 Cross Site Scripting
Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting XSS Date: 07/01/2022 Exploit Author: Oscar Sandén Vendor Homepage: https://www.element-it.com Software Link: https://www.element-it.com/downloads.aspx Version: 3.1.9 Tested on: Windows Server 2016 Description There is a stored XSS ...
PT-2022-10512 · Gpac · Gpac
Name of the Vulnerable Software and Affected Versions: GPAC version 1.0.1 Description: A heap-based buffer overflow issue exists in MP4Box via the gp rtp builder do mpeg12 video function, allowing attackers to have unspecified impact through a crafted file in the MP4Box command. Recommendations:...
Incorrect Calculation in the MSR JavaScript Cryptography Library
A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library's Elliptic Curve Cryptography ECC implementation.An attacker could potentially abuse these bugs to learn information about a server's private ECC key a key...
Attackers Exploit Flaw in Google Docs’ Comments Feature
Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered. Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of...
DayByDay CRM Information Disclosure Vulnerability (CNVD-2022-68550)
DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. An information disclosure vulnerability exists in DayByDay CRM. The vulnerability stems from the product's update feature that does not...
Daybyday CRM 处理逻辑错误漏洞
DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. An information disclosure vulnerability exists in DayByDay CRM. The vulnerability stems from the product's update feature that does not...
Google Chrome 安全特征问题漏洞
Google Chrome is a Web browser from the U.S. company Google Google. Google Chrome is vulnerable to a security feature issue that exists due to an incorrect implementation of a vulnerability in automatically populating Google Chrome. A remote attacker could exploit the vulnerability to be able to...
Google Chrome 安全特征问题漏洞
Google Chrome is a Web browser from Google, Inc. A security feature vulnerability exists in Google Chrome, which stems from an incorrect implementation of the product's Compositing feature. A remote attacker could exploit the vulnerability to create a specially designed web page, tricking victims...
CVE-2021-44858
A flaw was found in mediawiki. The "undo" feature action=edit== allowed an attacker to view the contents of arbitrary revisions, regardless of whether they had permissions to do so. This was also found in the "mcrundo" and "mcrrestore" actions action=mcrundo and action=mcrrestore...
Malicious code in bootstrap-feature (npm)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3db5e43a78e41f050b0e265c951bc776e693abd20a01108e6c8ea2e15a5e7c4d Malicious packages campaign since 2021 targeting developers, steals source code and secrets...
Trendnet AC2600 TEW-827DRU Access Control Error Vulnerability
Trendnet AC2600 TEW-827DRU is a wireless router.A security vulnerability exists in Trendnet AC2600 TEW-827DRU version 2.08B01, which stems from a lack of proper authentication for the bittorrent feature. If enabled, an attacker could exploit the vulnerability to access and modify settings and fil...
Trendnet AC2600 访问控制错误漏洞
Trendnet AC2600 TEW-827DRU is a wireless router.A security vulnerability exists in Trendnet AC2600 TEW-827DRU version 2.08B01, which stems from a lack of proper authentication for the bittorrent feature. If enabled, an attacker could exploit the vulnerability to access and modify settings and fil...
X (Formerly Twitter): Improper santization of edit in list feature at twitter leads to delete any twitter user's list cover photo.
An improper sanitization of the edit list feature at Twitter allowed an attacker to delete any Twitter user's list cover photo. By manipulating the media ID in the request, the attacker could delete the victim's cover photo, violating access controls...
Brave Software: Universal XSS with Playlist feature
A Universal XSS vulnerability was discovered in Brave iOS versions 1.32.3 and higher. The vulnerability was caused by three weaknesses, including the exposure of UserScriptManager.securityToken and UserScriptManager.messageHandlerToken, as well as a UXSS vulnerability in PlaylistHelper through...
CVE-2021-45687
An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...
Lantronix PremierWave 2050 path traversal vulnerability (CNVD-2022-01589)
The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. It is used to provide reliable and always-on 5G Wi-Fi connectivity. The Lantronix PremierWave 2050 suffers from a path traversal vulnerability that stems from the lack of effective restrictions and filters ...
Security feature bypass
Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...
