Chinese APT group targets financial institutions in the campaign “Operation Cache Panda”

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Chinese threat actor APT10 conducted a series of large-scale supply chain attacks that exclusively targeted the financial software systems of Taiwanese financial institutions from the end of November 2021 until the middle of...

MetadataExtractor 安全漏洞

IBM Jazz Reporting Service helps you quickly and easily integrate data from a variety of data sources across your tools and projects, and provides a set of ready-to-use reports for sharing information about your lifecycle management projects. A cross-site scripting vulnerability exists in IBM Jaz...

Tongda2000 SQL注入漏洞

Tongda2000 is a web-based intelligent office system from Tongda, China. a SQL injection vulnerability exists in Tongda2000 v11.10, which stems from the product's failure to effectively filter the special characters in the DELETESTR parameter of the delete.php file. An attacker could use this...

Vicidial 2.14-783a SQL Injection Vulnerability

=============== Vicidial v2.14-783a - DB SQL Injection Web Vulnerability Vulnerability Class: ==================== SQL Injection Current Estimated Price: ======================== 1.000€ - 2.000€ Product & Service Introduction: =============================== Vicidial is a software suite that is...

Vicidial v2.14-783a - (DB) SQL Injection Web Vulnerability

Document Title: =============== Vicidial v2.14-783a - DB SQL Injection Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2312 Release Date: ============= 2022-02-17 Vulnerability Laboratory ID VL-ID: ====================================...

Cisco Prime Infrastructure 跨站脚本漏洞

Cisco Prime Infrastructure is an application from Cisco, Inc. A cross-site scripting vulnerability exists in Cisco Prime Infrastructure and Cisco EPN Manager, which could be exploited by an attacker to execute arbitrary script code or access sensitive browser-based information in the context of t...

UBUNTU-CVE-2022-24586

A stored cross-site scripting XSS vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters...

CVE-2021-46558

Multiple cross-site scripting XSS vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields...

S-cart 路径遍历漏洞

S-cart, a Php-based e-commerce management platform from the S-cart community, suffers from a path traversal vulnerability that stems from the failure of a web-based system or product to properly filter special elements in the path of a resource or file. An attacker could exploit the vulnerability...

Rails Action Pack 信息泄露漏洞

Rails Action Pack is a web framework from the US Rails community. It provides a routing mechanism mapping request URLs to actions, a controller that defines the implementation of actions and a mechanism for generating responses by rendering views templates in various formats.Rails Action Pack has...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A buffer error vulnerability exists in Mozilla Firefox that stems from the product's failure to properly determine memory boundaries when processing HTML content. A remote attacker could create a specially crafted website,...

CVE-2021-29394

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...

CVE-2021-44978

iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...

Northstar Club Management 安全漏洞

Northstar Club Management is a web-based solution from Northstar, Inc. that allows organizations to manage all elements of a club, such as memberships, guests, events, and more. A security vulnerability exists in Northstar Club Management version 6.3, which stems from a lack of valid filtering an...

The vulnerability in the web interface of the server software for managing Cisco Prime Access Registrar (CPAR) allows a attacker to perform cross-site scripting attacks.

The vulnerability of the web interface for managing server software, which enables scalability and extensibility of Cisco Prime Access Registrar CPAR, is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site...

Sensio Labs Symfony 跨站请求伪造漏洞

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools that can be used to quickly create complex web programs. A cross-site request forgery vulnerability exists in...

CVE-2022-23993

/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $REQUEST'pkgfilter' in a PHP echo call, causing XSS...

Sourcecodester Hospital Patient Records Management System 跨站脚本漏洞

Sourcecodester Hospital Patient Records Management System is a Web-based application that provides hospitals with an automated platform to store and manage their patient records. sourcecodester Hospital Patient Records A cross-site scripting vulnerability exists in v1.0 of the Management System...

CVE-2022-23013

On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

TransmitMail 路径遍历漏洞

TransmitMail is a Php-based email form system developed by Tagawa Takao, a Japanese individual developer. TransmitMail suffers from a path traversal vulnerability that stems from insufficient processing of user-supplied data. A remote attacker could trick a victim into following a specially craft...