9434 matches found
CVE-2022-40004
Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...
CVE-2022-32860
An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, macOS Big Sur 11.6.8. An app may be able to execute arbitrary code with kernel privileges...
CVE-2022-34271 Apache Atlas: zip path traversal in import functionality
A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0...
CVE-2022-4446 PHP Remote File Inclusion in tsolucio/corebos
PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0...
A week in security (December 5 - 11)
Last week on Malwarebytes Labs: Security advisories are falling short. Here's why, with Dustin Childs: Lock and Code S03E25 Eufy "no cloud" security cameras streaming data to the cloud Snapchat gives Californians more power over their personal data Update now! Emergency fix for Google Chrome's V8...
The vulnerability in the web interface for managing microprogramming software on Cisco Firepower Threat Defense (FTD) allows a perpetrator to enhance their privileges.
The vulnerability of the web-based interface for managing Microprogramming Software on Cisco Firepower Threat Defense FTD is related to resource management errors during the identification of endpoints. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending...
ARC Informatique PcVue 安全漏洞
ARC Informatique PcVue is a multifunctional HMI-SCADA software from ARC Informatique, France, an all-in-one solution that monitors all aspects of a customer's assets.PcVue is used in a wide range of applications such as industrial control, building management, energy management, smart grids, ener...
CVE-2022-4261 Rapid7 Nexpose Update Validation Issue
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide ...
Vehicle Identification Numbers reveal driver data via telematics
There are many ways that data collection, and data availability, make less sense as the years pass by. This is frequently accompanied by a resistance to change, to improve these processes, because "thats how weve always done it". Sadly this is often the case even when those data collectors have...
CVE-2022-39091
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-42773
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services...
CVE-2022-39134
In audio driver, there is a use after free due to a race condition. This could lead to local denial of service in kernel...
CVE-2022-39101
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
SiriusXM Vulnerability Lets Hackers Remotely Unlock and Start Connected Cars
Cybersecurity researchers have discovered a security vulnerability that exposes cars from Honda, Nissan, Infiniti, and Acura to remote attacks through a connected vehicle service provided by SiriusXM. The issue could be exploited to unlock, start, locate, and honk any car in an unauthorized manne...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...
CVE-2022-4232
A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB-214590 is the identifier assigned to...
CVE-2022-45331
creationtimestamp| type| source ---|---|--- 2022-11-23 00:13:16+00:00| seen| https://t.me/cibsecurity/53380 2025-04-25 22:07:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13553...
CVE-2022-44252
TOTOLINK NR1800X V9.1.0u.6279B20210910 contains a command injection via the FileName parameter in the setUploadSetting function...
CVE-2022-36111 immundb has insufficient verification of data authenticity
immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a...