309 matches found
Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables
THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...
MoonBounce: New malware deployed by APT41 in UEFI firmware
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. MoonBounce is a new type of malware that hides in the most complex part of an Operating System OS, the Basic Input Output System BIOS chip, and thus persists even after reinstalling your OS or formatting your hard drive...
The vulnerability of Cisco Small Business 220 Series Smart Switch microprogramming software lies in the lack of protection for service data. This allows a hacker to gain access to confidential login credentials or alter user passwords within the user account.
The vulnerability of the microprogrammed software of Cisco Small Business 220 Series Smart Switches lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain access to login credentials or reconfigure passwords in the user account...
The vulnerability of Cisco Small Business 220 Series Smart Switch microprogramming software lies in the lack of protection for service data. This allows a hacker to gain access to confidential login credentials or alter user passwords within the user account.
The vulnerability of the microprogrammed software of Cisco Small Business 220 Series Smart Switches lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain access to login credentials or reconfigure passwords in the user account...
Hitachi Energy Relion 访问控制错误漏洞
Hitachi Energy Relion is used by Hitachi Energy Switzerland to protect, control, measure, and monitor power systems. A security vulnerability exists in the internal database access mechanism of the Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600, which arises from the product'...
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker...
CVE-2021-42330
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters...
Mitsubishi Electric MELSEC iQ-R series 安全漏洞
Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC iQ-R series series Secure CPU R08/16/32/120SFCPU and the MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU, which can b...
PT-2021-5709 · Cisco · Cisco Business 220 Series Smart Switches
Name of the Vulnerable Software and Affected Versions: Cisco Business 220 Series Smart Switches affected versions not specified Description: The issue is related to a lack of protection for service data in the firmware of Cisco Small Business 220 Series Smart Switches. An attacker with...
CVE-2021-35529
Insufficiently Protected Credentials vulnerability in client environment of Hitachi ABB Power Grids Retail Operations and Counterparty Settlement Billing CSB allows an attacker or unauthorized user to access database credentials, shut down the product and access or alter. This issue affects:...
CVE-2021-28372
CVE-2021-28372 affects ThroughTek’s Kalay Platform (Kalay Platform 2.0) and Kalay P2P SDK. The root cause is a device impersonation flaw: an attacker who obtains a valid 20-byte Kalay UID can register or hijack a device on the Kalay network, causing client connections to be redirected and enablin...
Oracle Linux 8 : olcne (ELSA-2021-9396)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9396 advisory. - Address Istio CVE's CVE-2021-28683, CVE-2021-28682, CVE-2021-29258, CVE-2021-31920, CVE-2021-31921, CVE-2021-34824 istio - Address CVE-2021-28683,...
Awesome-Red-Teaming
This is an offensive tool for Red Teaming. It is a list of resources for anyone wishing to learn about Red Teaming, including initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, command and contro...
QSAN Storage Manager Directory Traversal Vulnerability
QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A directory traversal vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. An attacker could use this vulnerability to list arbitrary directories and further access...
QSAN Storage Manager 安全漏洞
QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A directory traversal vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. An attacker could use this vulnerability to list arbitrary directories and further access...
CVE-2021-34824
Istio 1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces...
ZOLL Defibrillator Dashboard 安全漏洞
ZOLL Defibrillator Dashboard is a defibrillator management tool. A vulnerability exists in ZOLL Defibrillator Dashboard prior to version 2.2 where passwords are stored in a recoverable format. An attacker could exploit this vulnerability to retrieve credentials from a web browser...
Jenkins 安全漏洞
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins XebiaLabs XL Deploy Plugin version 7.5.8 and earlier versions that allows an...
PT-2021-14695 · Jenkins · Jenkins Xray - Test Management For Jira Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Xray - Test Management for Jira Plugin versions 2.4.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained...
