CVE-2021-45468

Imperva Web Application Firewall WAF before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF...

Microsoft SharePoint Server-Side Control Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft SharePoint. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of server-side controls. An unsafe server-side control can be instantiated...

CVE-2021-43762

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability...

Security feature bypass

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability...

CVE-2021-43762

CVE-2021-43762 affects Adobe Experience Manager (AEM) Cloud Service and on‑prem 6.5.10.0 and earlier, via a dispatcher bypass that could bypass security controls and expose sensitive areas of the web app. The issue is documented across multiple sources (NVD/NVDA, Nessus APSB21-103). Remediation i...

CVE-2021-43762 Adobe Experience Manager Unicode normalization leads to dispatcher bypass

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability...

Mitsubishi Electric MELSEC-F Series 安全漏洞

The Mitsubishi Electric MELSEC-F Series is a basic micro PLC with scalable analog and communication functions for industrial control devices from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC-F Series that stems from a lack of administrative controls...

Snipe-IT 访问控制错误漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, which stems from the presence of improper access controls in the software. No details of the vulnerability are currently available...

GHSA-QC9X-GJCV-465W Pipenv's requirements.txt parsing allows malicious index url in comments

Issue Summary Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file e.g. with "pipenv install -r requirements.txt...

Faking an iPhone Reboot

Researchers have figured how how to intercept and fake an iPhone reboot: Well dissect the iOS system and show how its possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, its still running. The "NoReboot" approach...

Johnson Controls VideoEdge

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc. Equipment: VideoEdge Vulnerability: Improper Handling of Syntactically Invalid Structure= 2. RISK EVALUATION Running a vulnerability...

PT-2022-1521 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access controls in the Windows GDI+ component, which can be exploited to disclose protected information. This can allow an attacker to obtain sensitive...

Johnson Controls VideoEdge 安全漏洞

Johnson Controls VideoEdge is a security solution from Johnson Controls, Inc. A security vulnerability exists in Johnson Controls VideoEdge that could result in a denial of service...

The 2021 Naughty and Nice Lists: Cybersecurity Edition

Editor’s note: We had planned to publish our Hacky Holidays blog series throughout December 2021 – but then Log4Shell happened, and we dropped everything to focus on this major vulnerability that impacted the entire cybersecurity community worldwide. Now that it’s 2022, we’re feeling in need of...

CVE-2021-42748

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

CVE-2021-42748

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

Security feature bypass

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

The vulnerability of the Java-programming logging library Apache Log4j2 lies in the lack of additional JNDI control elements, allowing attackers to execute arbitrary code.

The vulnerability of the Apache Log4j2 Java-programming logging library is related to the absence of additional JNDI control elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using JDBC Appender...

Facebook Launches 'Privacy Center' to Educate Users on Data Collection and Privacy Options

Meta Platforms, the company formerly known as Facebook, on Friday announced the launch of a centralized Privacy Center that aims to "educate people" about its approach with regards to how it collects and processes personal information across its family of social media apps. "Privacy Center provid...

CVE-2021-42748

CVE-2021-42748 affects Beaver Builder up to version 2.5.0.3. The issue allows attackers to bypass the visibility controls protection mechanism via the REST API, enabling unauthorized exposure of content. The vulnerability’s root cause is a bypass of visibility controls in REST API handling, with ...