Accused ‘Raccoon’ Malware Developer Fled Ukraine After Russian Invasion

A 26-year-old Ukrainian man is awaiting extradition from The Netherlands to the United States on charges that he acted as a core developer for Raccoon, a popular "malware-as-a-service" offering that helped paying customers steal passwords and financial data from millions of cybercrime victims...

Sql injection

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploi...

CVE-2022-37913

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

Design/Logic Flaw

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands o...

Authentication flaw

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

CVE-2022-37913

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

CVE-2022-3733

SourceCodester Web-Based Student Clearance System is affected. The vulnerability is in Admin/edit-admin.php where manipulating the id parameter triggers a SQL injection. It can be exploited remotely and publicly disclosed; no remediation details are provided in the supplied documents.

Eaton Foreseer EPMS 代码问题漏洞

Eaton Foreseer EPMS is a highly customizable web-based software platform from Eaton Corporation. A code issue vulnerability exists in Eaton Foreseer EPMS versions prior to v7.6, where a malicious attacker could upload arbitrary files using the file upload feature...

CVE-2022-37914

Authentication bypass vulnerability in Aruba EdgeConnect Enterprise Orchestrator’s web-based management interface could allow an unauthenticated remote attacker to gain administrative privileges and fully compromise the system. Affected versions include 9.1.2.40051 and below, 9.0.7.40108 and belo...

CVE-2022-3733: Improper Neutralization

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploi...

CVE-2022-3733 SourceCodester Web-Based Student Clearance System edit-admin.php sql injection

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploi...

Cross site scripting

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user...

CVE-2022-40183 Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user...

CVE-2022-40183: Improper Neutralization of Input During Web Page Generation

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user...

PT-2022-25265 · Unknown · Videojet Multi 4000

Name of the Vulnerable Software and Affected Versions: VIDEOJET multi 4000 affected versions not specified Description: The issue concerns incomplete filtering of JavaScript code in different configuration fields of the web-based interface. An attacker with administrative credentials can store...

CVE-2022-40183 Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user...

CVE-2022-20959 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the External RESTful Services ERS API of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient input...

CVE-2022-20822

Cisco Identity Services Engine (ISE) is affected via its web-based management interface. The root cause is insufficient validation of user-supplied input, enabling authenticated, remote attackers to read and delete files by sending crafted HTTP requests with path-sequence characters. Reported imp...

CVE-2022-20822 Cisco Identity Services Engine Unauthorized File Access Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...

CVE-2022-20822: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...