U.S. Dept Of Defense: AEM misconfiguration leads to Information disclosure

Sensitive information was disclosed due to a misconfiguration in AEM, allowing access to internal usernames and webroot directories by appending /.1.json to certain URLs. This could lead to unauthorized access, social engineering attacks, and reputation damage...

Music Gallery Site v1.0 - SQL Injection Vulnerability (2)

Exploit Title: Music Gallery Site v1.0 - SQL Injection on page viewmusicdetails.php Exploit Author: Muhammad Navaid Zafar Ansari CVE Assigned: CVE-2023-0961 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari Vendor Homepage: https://www.sourcecodester.com Software Link: Music Galler...

U.S. Dept Of Defense: Path traversal leads to reading of local files on ███████ and ████

A directory traversal vulnerability was discovered in the downloadForm endpoint of a web application, allowing an attacker to read files on the system by adding "../" to the filename parameter. This could potentially lead to the disclosure of sensitive information or system compromise. The...

Music Gallery Site 1.0 SQL Injection Vulnerability

Music Gallery Site - SQL Injection on page musiclist.php and parameter cid is vulnerable, application url is ?page=musiclist&cid=?. Any remote attacker can access this page to exploit the vulnerbility. CVE Assigned: CVE-2023-0938 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari...

Controller-level flaws can let hackers physically damage moving bridges

By Waqas Sophisticated hackers can now breach vulnerable networks and devices at the controller level of critical infrastructure, causing physical damage to crucial assets. This is a post from HackRead.com Read the original post: Controller-level flaws can let hackers physically damage moving...

Trend Micro Apex One Multiple Vulnerabilities (000291830)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 11136 and Agent Build 11136. It is, therefore, affected by multiple vulnerabilities: - An arbitrary file deletion vulnerability in the Damage Cleanup Engine...

The vulnerability of the Damage Cleanup Engine in the Trend Micro Maximum Security antivirus protection software allows a malicious actor to enhance their privileges.

The vulnerability of the Damage Cleanup Engine in the Trend Micro Maximum Security antivirus software is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to increase their privileges...

Potential Manipulation Vulnerability in _validateOrdersAndPrepareToFulfill Function

Lines of code Vulnerability details Impact The smart contract may not be properly validated, which could lead to fraudulent or malicious orders being fulfilled. This could result in loss of assets or other financial damage to users of the contract. Additionally, if the validation process is not...

Trend Micro Maximum Security Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

mintFee can be set to 100%

Lines of code Vulnerability details Impact The mintFee can be set to 100%. An amount of centralization over the usual is to be expected in a protocol that deals with RWAs and requires KYC but being able to set the fee to 100% is unnecessary, dangerous, and could harm Ondo's reputation. Proof of...

PT-2022-6208 · Trend Micro · Trend Micro Maximum Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Maximum Security version 17.7 Description: A vulnerability exists in Trend Micro Maximum Security wherein a low-privileged user can write a known malicious executable to a specific location. During the removal and restoration...

Multiple vulnerabilities in Trend Micro Apex One and Apex One as a Service

Overview Trend Micro Incorporated has released security updates for Apex One and Apex One as a Service. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. Impact Privilege escalation and file deletion in Damage Cleanup Engine compone...

CVE-2022-45798

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Please note: an attacker must first obtain...

Reddit: Reflected XSS via File Upload

Vulnerability description not provided...

The vulnerability of the Damage Cleanup Engine component in Trend Micro Apex One and Apex One as a Service anti-virus software allows a malicious actor to elevate their privileges and delete arbitrary files.

The vulnerability of the Damage Cleanup Engine component in Trend Micro Apex One and Apex One as a Service anti-virus software exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability can allow attackers to enhance their privileges and...

CVE-2022-45798

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Please note: an attacker must first obtain...

CVE-2022-45798

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Please note: an attacker must first obtain...

CVE-2022-45798

Trend Micro Apex One and Apex One as a Service are affected by a local privilege-escalation vulnerability in the Damage Cleanup Engine. An attacker who can run low-privilege code can abuse a symbolic link to cause file deletion through the Damage Cleanup Engine. Impact is privilege escalation and...

CVE-2022-45798: Improper Link Resolution Before File Access

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Please note: an attacker must first obtain...

reentrancy

Lines of code Vulnerability details Impact If an attacker were able to successfully exploit a reentrancy vulnerability in this contract, they could potentially cause the contract to enter an infinite loop, consuming all available gas and rendering it unusable. This could result in financial losse...