PT-2022-30083

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.33 Description The issue concerns a fix in the return value of the setup handler in kgdboc. It was introduced in version v4.20 and fixed in version v5.15.33. The actual impact and attack plausibility have n...

PT-2022-29767

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue concerns a fix in the return value of the setup handler. It was introduced in version v4.20 and fixed in version v5.16.19. The actual impact and attack plausibility have not yet bee...

PT-2022-29922

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.15.35 Description The issue concerns a protocol setup fix for non-1-1-X operations in the cadence-quadspi driver. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-30767

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.311 Description The issue concerns a fix in the return value of the setup handler. It was introduced in version v4.9.137 and fixed in version v4.9.311. The actual impact and attack plausibility have not yet...

PT-2022-30701

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.276 Description The issue concerns a fix in the return value of the setup handler. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2022-29241

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.4 Description The issue concerns a protocol setup fix for non-1-1-X operations in the cadence-quadspi driver. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

CVE-2022-24869: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack...

CVE-2021-43986

The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve privilege escalation...

CVE-2021-43986

The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve privilege escalation...

CVE-2021-43986 ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform

The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve privilege escalation...

CVE-2021-43986

CVE-2021-43986 affects FANUC ROBOGUIDE (simulation platform). The issue stems from the setup program configuring files/folders with full access, allowing an attacker with SYSTEM-level access to overwrite binaries and escalate privileges. This is part of a broader set of ROBOGUIDE vulnerabilities ...

PT-2022-11966 · Fanuc · Roboguide

Name of the Vulnerable Software and Affected Versions: Affected product affected versions not specified Description: The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve...

CWA 2202 : Published desktop fails to launch when CWA is used

-- Issue with CWA only -- Same endpoint works when same VDA is launched from Store URL -- Issue with 1 end point only -- Never worked on the CWA -- First time set up Details...

Veritas NetBackup 跨站脚本漏洞

Veritas NetBackup is a storage service used by Veritas, Inc. to provide backup and recovery capabilities for enterprise environments. Veritas NetBackup OpsCenter Analytics version 9.1 is vulnerable to a cross-site scripting vulnerability caused by a failure to effectively escape and filter the...

PT-2022-13577 · Siteground · Siteground Security Plugin

Name of the Vulnerable Software and Affected Versions: SiteGround Security plugin for WordPress versions up to, and including, 1.2.5 Description: The issue allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up. This enables...

ZOHO ManageEngine ADSelfService Plus 安全漏洞

An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...

linWinPwn - A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks

linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script leverages and is dependent of a number of tools including: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump. Setup Git clone the reposito...

PT-2022-7390

Name of the Vulnerable Software and Affected Versions Bitrix versions prior to 7.5.0 Description The issue is related to the unrestricted upload of dangerous file types in the "1C-Bitrix: Virtual Machine" VMBitrix virtual server. This can be exploited by a remote attacker to execute arbitrary cod...

EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers

EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add SSH keys to...

CVE-2021-27768

Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...