5794 matches found
CVE-2022-23737 Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion
An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This...
HackerOne: Any organization's assets pending review can be downloaded
Steps to reproduce - sign in as any user - visit https://hackerone.com/organizations/:handle/assets/downloadpendingreviews.csv, where :handle is the organization you want to download the assets for Impact This may leak sensitive data about an organization's attack surface...
youth.org.mt Cross Site Scripting vulnerability OBB-3076501
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2020-26784
CVE-2020-26784 is referenced in Windows update records as a Denial of Service issue affecting Cluster Shared Volumes (CSV). The connected MSKBs (KB5012596, KB5012599, KB5012604, KB5012647, KB5012670) indicate that the CSV DoS issue is addressed/improved in the April 2022 security updates across m...
CVE-2018-8590
CVE-2018-8590 is a remote code execution vulnerability in Microsoft Word caused by improper handling of objects in memory. An attacker can exploit it by tricking a user into opening a specially crafted Word document, delivered via email, the web, or another vector. The connected TALOS blog entry ...
CVE-2020-1341
CVE-2020-1341 affects Microsoft Edge (Chromium-based). The issue is an Elevation of Privilege when DLLs are allowed to download without an additional user prompt. Exploitation requires a user to browse to a malicious site and initiate a DLL download, which could lead to elevated privileges on the...
CVE-2019-1491
Summary (CVE-2019-1491) : A Microsoft SharePoint Server information-disclosure vulnerability allows an attacker to read arbitrary files on the server by sending a specially crafted request. Public details from multiple sources confirm exploitation requires targeting affected SharePoint APIs and r...
CVE-2020-0817
CVE-2020-0817 corresponds to a remote code execution flaw in the Windows Remote Desktop Client. The connected advisory CPAI-2020-0074 states there is a remote code execution vulnerability in the Windows Remote Desktop Client and that successful exploitation could allow an attacker to run arbitrar...
CVE-2020-0818
Technical details for CVE-2020-0818 are not publicly available in the provided documents. Monitor for updates as information may be released later.
WordPress Organization chart plugin <= 1.4.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Lana Codes Patchstack Alliance in the WordPress Organization chart plugin versions = 1.4.1. Solution Update the WordPress Organization chart plugin to the latest available version at least 1.4.2...
Bouncy Castle BC Code Issue Vulnerability
Bouncy Castle BC is a cryptographic library for C and Java applications organized by Bouncy Castle. A code issue vulnerability exists in Bouncy Castle BC-FJA versions prior to 1.0.2.4, which stems from a temporary key used by the BC-FJA FIPS module that may be zeroed out while the module is still...
Google TensorFlow code issue vulnerability (CNVD-2022-80685)
Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A code issue vulnerability exists in Google TensorFlow, which stems from a logical error in the organization of data, where the conversion from char to bool is undefined if the const char array is not 0...
Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti
Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti By Jambul Tologonov· November 22, 2022 Introduction On October 31, 2022, Yanluowang’s TOR site was hacked displaying a message “check and mate!! Yanluowang Matrix chat hacked @yanluowangleaks Time’s...
Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti
Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti By Jambul Tologonov· November 22, 2022 Introduction On October 31, 2022, Yanluowang’s TOR site was hacked displaying a message “check and mate!! Yanluowang Matrix chat hacked @yanluowangleaks Time’s...
CVE-2022-2944
The connected document details a vulnerability in the WordPress Countdown Widget plugin (WordPress) where versions prior to 3.1.9.3 are affected by an Admin+ Stored XSS flaw. The issue arises from inadequate sanitisation/escaping of certain parameters, enabling stored cross-site scripting by high...
CVE-2022-2940
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2022-42903
Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...
Code injection
Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...
CVE-2022-42903
Summary: CVE-2022-42903 affects Zoho ManageEngine SupportCenter Plus up to version 11.0 Build 11024. The issue allows low-privileged users to view the organization users list, indicating an access-control exposure. Affected product/versions (per provided documents): Zoho ManageEngine SupportCente...