CVE-2022-22452

IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 224918...

CVE-2022-35227

A vulnerability in SAP NW EP WPC - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site XSS scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to...

PT-2022-3850 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient access controls in Azure Site Recovery, specifically in the context of VMWare to Azure recovery. It may allow a remote attacker to disclose...

The vulnerabilities of the Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) systems, along with the integrated messaging system Cisco Unity Connection, stem from insufficient protection of operational data. This allows attackers to gain unauthorized access to protected information.

The vulnerabilities of the Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME systems, as well as the integrated messaging system Cisco Unity Connection, are related to insufficient protection of operational data. Exploiting these...

Weak Password Change Mechanism

Description When setting a new user password it does not require knowledge of the original password Current password not required Proof of Concept 1. Log in as a regular user 2. Navigate: https://book.dansmonorage.blue/preferences/password 3. Enter any password string...

IBM Security Access Manager Appliance 加密问题漏洞

IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from IBM, USA. The product is mainly used for access control and Web-based threat protection, providing system performance monitoring, log analysis and diagnosis. A security vulnerability exists in...

The vulnerability of the administrator.cfc component in the ColdFusio software interface allows a hacker to bypass security restrictions or execute arbitrary code.

The vulnerability of the administrator.cfc component in the ColdFusion software interface is related to insufficient protection of sensitive data. Exploiting this vulnerability allows an attacker to bypass security restrictions or execute arbitrary code...

The vulnerability of the Scripting component of the Java Runtime Environment and the Java Development Kit, which allows attackers to influence the integrity, accessibility, and confidentiality of protected information.

The vulnerability of the Scripting component of the Java Runtime Environment and the Java Development Kit application development tools is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to influence the integrity, accessibility, and...

The vulnerability of the Nomad application orchestrator’s go-getter library allows a hacker to elevate their privileges.

The vulnerability of the Nomad application’s go-getter orchestrator library is related to deficiencies in access control when using the artifact stanza structure. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

The vulnerability of the QTS operating system lies in its inability to neutralize special elements used in the OS command line, allowing attackers to execute arbitrary commands.

The vulnerability of the QTS operating system is related to the lack of measures taken to neutralize special elements used in the OS commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the IPersistFile interface implementation in the Matrikon OPC Server allows a perpetrator to execute arbitrary code.

The vulnerability of the IPersistFile interface implementation in the Matrikon OPC Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Slurm resource manager management module, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the Slurm resource manager is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions from a remote location...

Weak Password Policy

Description This application commafeed is using a weak password policy. Acunetix was able to guess the credentials required to access this page. A weak password is short, common, a system default, or something that could be rapidly guessed by executing a brute force attack using a subset of all...

Mutation Stored XSS at homepage

Description bookwyrm HTML input sanitizer is vulnerable to Mutation XSS. The payload could be stored and displayed on the homepage of the website path /feed or /discovery making it widely affects all users and the main website. Proof of Concept Edit a book description: // PoC Access to the /feed...

The vulnerability of the REST API interface implementation in the software environment for the Zoho ManageEngine ServiceDesk Plus service allows a hacker to circumvent existing security restrictions.

The vulnerability of the REST API interface implementation for the Zoho ManageEngine ServiceDesk Plus technical support service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions from a...

Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak CVE-2022-1012 kernel: race condition in perfeventopen leads to privilege escalation...

The vulnerability of the Authenticated Code Module (ACM) in Intel microprogramming system BIOS allows a hacker to enhance their privileges.

The vulnerability of the Authenticated Code Module ACM in Intel microprogramming system BIOS is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the `startLegacyVpnPrivileged` component in Android operating systems allows a hacker to elevate their privileges.

The vulnerability of the startLegacyVpnPrivileged component in Android operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multifunctional monitoring devices, related to deficiencies in authentication procedures, allows attackers to delete security log files.

The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multi-functional measuring devices is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to remotely delete security log files...

The vulnerability of the enterprise management server through the Internet-based Open Management Infrastructure (OMI) for virtual machine management in Azure allows attackers to escalate their privileges due to lack of access control mechanisms.

The vulnerability of the enterprise management server through the Internet-based Open Management Infrastructure OMI extensions for managing virtual machines in Azure is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...