D-Link G416 安全漏洞

The D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 and supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection remote code execution vulnerability, which stems from a nodered chmo...

Bosch Security Systems B426 Improper Access Control (CVE-2021-23845)

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

CVE-2023-6780

creationtimestamp| type| source ---|---|--- 2024-01-31 15:21:59+00:00| seen| https://t.me/ctinow/176815 2024-01-31 15:31:42+00:00| seen| https://t.me/ctinow/176822 2024-01-31 17:00:10+00:00| seen| https://t.me/truesecator/5359 2024-02-01 08:59:09+00:00| seen|...

Active Exploitation of Two Critical Flaws in Microsoft SharePoint

Summary: Active attacks targeting a critical Microsoft SharePoint Server vulnerability CVE-2023-29357 pose a severe risk, enabling privilege escalation for potential full administrator access. This flaw, coupled with CVE-2023-24955, allows arbitrary code execution. Immediate patching is crucial, ...

Play Ransomware A Global Threat Impacting Businesses

Summary: The Play ransomware group, active since June 2022, employs a double-extortion model, impacting businesses globally. Utilizing legitimate tools for malicious activities, the group has affected approximately 300 entities. Threat Level - Red | Attack Report For a detailed threat advisory,...

june-partners.com Improper Access Control vulnerability OBB-3802230

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-32837

creationtimestamp| type| source ---|---|--- 2023-11-06 07:30:38+00:00| seen| https://t.me/cibsecurity/73569 2024-06-13 18:03:00+00:00| seen| https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html 2025-04-25 16:07:11+00:00| published-proof-of-concept|...

CVE-2023-45247

creationtimestamp| type| source ---|---|--- 2023-10-09 16:16:06+00:00| seen| https://t.me/cibsecurity/71838 2023-11-01 13:42:51+00:00| seen| https://t.me/ETHICALHACKERSCOMMUNITY2/3224 2025-06-16 17:37:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18478...

CVE-2023-39141

creationtimestamp| type| source ---|---|--- 2023-08-22 22:18:09+00:00| seen| https://t.me/cibsecurity/68965 2023-08-30 02:38:36+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5034 2023-08-31 10:59:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8944...

CVE-2023-2917

creationtimestamp| type| source ---|---|--- 2023-08-17 20:37:33+00:00| seen| https://t.me/cibsecurity/68770 2025-06-04 21:56:31+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/thinmanagertraversalupload2.rb 2025-06-05 21:02:22+00:00| seen...

CVE-2023-38198

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023...

CVE-2023-38198

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023...

CISA and FBI Release Cybersecurity Advisory on Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

The Cybersecurity and Infrastructure Security Agency CISA and Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory CSA, Enhanced Monitoring to Detect APT Activity Targeting Outlook Online, to provide guidance to agencies and critical infrastructure organizations on...

VulnCheck KEV: CVE-2023-38198

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023...

Threat Roundup for June 30 to July 7

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between June 30 and July 7. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Oracle Linux 9 : open-vm-tools (ELSA-2023-3948)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3948 advisory. 12.1.5-1.0.2 - CISA Major Incident CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module Tenable has extracted the preceding...

CISA Known Exploited Vulnerability Catalog June 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

web-sat.com Cross Site Scripting vulnerability OBB-3477368

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2023

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF022 and 22.0.2-IF006. Vulnerability Details CVEID:CVE-2022-43929 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows 11.1 a...

officemarket.am Cross Site Scripting vulnerability OBB-3477138

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...