PreMid 访问控制错误漏洞

PreMid is a simple, configurable utility from the German company PreMid. PreMiD version 2.2.0 contains a security vulnerability that could be exploited by an attacker to receive events from a socket and send them to a socket, thereby interfering with the victim's "Now Playing" state on Discord...

D-Link DIR-X1860 Denial of Service Vulnerability (CNVD-2022-11517)

The D-Link Dir-X1860 is a dual-band router from D-Link, a Chinese company. A specially designed URL to an authenticated victim to reboot the router. The authenticated victim would need to access the URL in order for the router to reboot...

D-Link DIR-X1860 has unspecified vulnerabilities

The D-Link Dir-X1860 is a dual-band router from D-Link China.A security vulnerability exists in the D-Link DIR-X1860, which stems from a reflected cross-site scripting attack in the D-Link DIR-X1860 web application prior to v1.10WWB09 Beta, which can be exploited by an attacker to sending a...

ModifiedElephant APT hackers plant incriminating evidence on victims devices

By Waqas ModifiedElephant APT group has been carrying out its malicious activities since 2012 and successfully evading detection for over… This is a post from HackRead.com Read the original post: ModifiedElephant APT hackers plant incriminating evidence on victims devices...

Code injection

A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to reboot the router via sending a specially crafted URL to an authenticated victim. The authenticated victim need to visit this URL, for the router to reboot...

Vulnerability fixed in Adobe Photoshop

Adobe has fixed a vulnerability in Photoshop. A malicious party can exploit the vulnerability to execute arbitrary code execute arbitrary code with the victim's privileges. The malicious party must entice the victim to open a rogue file to do so. Adobe has released updates to fix the vulnerabilit...

Vulnerability fixed in Adobe Creative Cloud Desktop

Adobe has fixed a vulnerability in the Creative Cloud Desktop Application. A malicious party could exploit the vulnerability to execute arbitrary code with the victim's privileges. The malicious party needs to trick the victim into opening a rogue file. Adobe has released updates to fix the...

Cross-site Scripting (XSS) - Reflected in effgarces/bookedscheduler

Setup the Booked Scheduler locally.URL like the following. http://192.168.5.5/phpsch/ Attcker 2. Login as valid user. 3. Make an reservation from the dashboard. 4. Open the information you reserved.URL like the following http://192.168.5.5/Web/reservation.php?rn=62020af2eee4d833634703 5. The...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

The vulnerability of the GNU Mailman email distribution management package lies in its insufficient verification of the HTTP request source, allowing attackers to execute attacks by manipulating inter-site requests.

The vulnerability of the GNU Mailman email distribution management package lies in insufficient validation of the HTTP request source. Exploiting this vulnerability could allow a malicious actor to trick the victim into visiting a specially crafted web page and performing arbitrary actions on...

New Wave of Cyber Attacks Target Palestine with Political Bait and Malware

Cybersecurity researchers have turned the spotlight on a new wave of offensive cyberattacks targeting Palestinian activists and entities starting around October 2021 using politically-themed phishing emails and decoy documents. The intrusions are part of what Cisco Talos calls a longstanding...

PT-2022-6478 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the lack of protection of the web page structure in Zabbix, allowing an authenticated user to create a link with a reflected XSS payload for actions' pages and send i...

Element Desktop 资源管理错误漏洞

Element Desktop is an open source Matrix client for the Element Web-centered desktop platform from Element. A resource management error vulnerability exists in Element Desktop that can be exploited by an attacker to specify the path to a binary file on the victim's computer...

GHSA-QC9X-GJCV-465W Pipenv's requirements.txt parsing allows malicious index url in comments

Issue Summary Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file e.g. with "pipenv install -r requirements.txt...

GitLab: Gitlab Pages token theft using service workers

Summary It is possible to steal Gitlab Pages session tokens by intercepting requests to the /auth endpoint on a Pages site using service workers. Attack Flow Setup 1. The attacker creates a private Gitlab Pages site at the root of their user page attacker.gitlab.io, ensuring that the project is...

VaderPoolV2 minting synths & fungibles can be frontrun

Handle cmichel Vulnerability details The VaderPoolV2 mintFungible and mintSynth functions perform an unsafe nativeAsset.safeTransferFromfrom, addressthis, nativeDeposit with a parameter-specified from address. Note that these functions are not called by the Router, they are directly called on the...

CVE-2021-43748

Adobe Premiere Rush versions 1.5.16 and earlier are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user...

CVE-2021-39054

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

Exploit for CVE-2021-1675

CVE-2021-1675 LPE PoC not my exploit! just wanted to play aro...

GitLab: Arbitrary POST request as victim user from HTML injection in Jupyter notebooks

Summary An attacker can create a Jupyter notebook that will make arbitrary POST requests as the victim user. In the "worst case" an attacker could make an admin create a new admin account for the attacker. Other possible attack vectors are forcing invites to private projects etc. Every POST reque...