Exploit for Improper Restriction of XML External Entity Reference in Zohocorp Manageengine_Adaudit_Plus

CVE-2022-28219 POC for CVE-2022-28219 affecting ManageEngine A...

State-Backed Hackers Using Ransomware as a Decoy for Cyber Espionage Attacks

A China-based advanced persistent threat APT group is possibly deploying short-lived ransomware families as a decoy to cover up the true operational and tactical objectives behind its campaigns. The activity cluster, attributed to a hacking group dubbed Bronze Starlight by Secureworks, involves t...

Malicious code in spotify-promise-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de122999e6fc807384186ab9aeb6da6a2f5b6e6217255a527c23a60f8bb540c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6261 Malicious code in spotify-promise-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de122999e6fc807384186ab9aeb6da6a2f5b6e6217255a527c23a60f8bb540c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-storage-common-cpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10f2d9d05c663e24ede071f09a82e5c1b34d19d1332c4c152be774f63703ed33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Zoho ManageEngine ADSelfService Plus Command Injection (CVE-2022-28810)

A command injection vulnerability exists in Zoho ManageEngine ADSelfService Plus. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

The vulnerability of the Lightspeed-Plus operating system for Cisco IOS XR routers of the Cisco ASR 9000 family allows a attacker to trigger a service failure.

The vulnerability of the Lightspeed-Plus operating system for Cisco IOS XR routers of the Cisco ASR 9000 family relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by sending specially crafted IPv4 or...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2022-60418)

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus is vulnerable to an informati...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

Design/Logic Flaw

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

CVE-2022-22396 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.9.3, where credentials may be disclosed in plaintext in the virgo log file in certain operations (remote vSnap, offload targets, or VADP credentials). API-key or certificate credentials are not printed. The issue’s root cause is infor...

CVE-2021-41932

A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQL injections, which can result in complete database compromise, gaining information about other users, unauthorized access to audit data etc...

IBM Spectrum Protect和IBM Spectrum Protect Plus 路径遍历漏洞

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus is vulnerable to an informati...

Vulnerability fixed in IBM Spectrum Protect Plus

IBM has fixed a vulnerability in Spectrum Protect Plus. Credentials of users are printed in readable text in the IBM Spectrum Protect Plus virgo log file. IBM has released updates to fix the vulnerabilities in Spectrum Protect Plus 10.1.0.0-10.1.9.32. For more information, see:...

Security Bulletin: IBM Spectrum Protect Plus may disclose sensitive information in virgo log file (CVE-2022-22396)

Summary IBM Spectrum Protect Plus may disclose credentials in clear text in the virgo log file. Vulnerability Details CVEID:CVE-2022-22396 DESCRIPTION: Credentials are printed in clear text in the IBM Spectrum Protect Plus virgo log file in certain cases. Credentials could be the remote vSnap,...

Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure

The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication PoC https://example.com/wp-json/wp/v2/coauthors...

WordPress Co-Authors Plus plugin <= 3.5.1 - Guest Authors Email Address Disclosure vulnerability

Guest Authors Email Address Disclosure vulnerability discovered by Douglas Johnson in WordPress Co-Authors Plus plugin versions = 3.5.1. Solution Update the WordPress Co-Authors Plus plugin to the latest available version at least 3.5.2...

Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure

The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication https://example.com/wp-json/wp/v2/coauthors...