CVE-2021-42627

D-Link DIR-615 devices running firmware 20.06 are affected by CVE-2021-42627. The WAN configuration page wan.htm can be accessed without authentication, enabling disclosure of WAN settings and potential modification of page data. The Nuclei template confirms unauthorized access and describes impa...

CVE-2022-34621

Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference IDOR vulnerability which allows attackers to modify user passwords and other attributes via modification of the userid parameter...

The vulnerability of the Hotspot component in Java SE software platforms, specifically the Oracle GraalVM Enterprise Edition virtual machine, allows attackers to create, delete, or alter access to data.

The vulnerability of the Hotspot component in Java SE software platforms, as well as in the Oracle GraalVM Enterprise Edition virtual machine, is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to create, delete, or modify access to data...

The vulnerability of the Core server component of Oracle WebLogic Server allows a hacker to gain access to modify, add, or delete data, or cause partial service disruption.

The vulnerability of the Core server component of Oracle WebLogic Server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely gain access to modify, add, or delete data, or cause a partial service outage using the IIOP and T3...

The vulnerability of the Libraries component of Java SE software platforms allows attackers to gain access to modify, add, or delete data.

The vulnerability of the Libraries component in Java SE software platforms is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to modify, add, or delete data using network packets...

Black Hat and DEF CON Roundup

There was nothing typical this year at BSides LV, Black Hat USA and DEF CON – also known collectively as Hacker Summer Camp. The weeklong collection of cybersecurity conferences featured an eclectic mix of attendees to learn, network, hack and have fun. The week even included a rare Las Vegas fla...

CVE-2022-28633

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...

Design/Logic Flaw

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...

CVE-2022-28633

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...

CVE-2022-28633

CVE-2022-28633 affects HPE Integrated Lights-Out 5 (iLO 5) firmware prior to 2.71. An unprivileged, local user can read and write to the iLO 5 firmware filesystem, resulting in complete loss of confidentiality and partial loss of integrity and availability. HPE provides a firmware update (2.71+) ...

Design/Logic Flaw

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain read, modify, add, or delete access to data.

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, or delete data...

The vulnerability of the Enterprise Manager Install component of the Enterprise Manager Base Platform allows a malicious individual to gain read, modify, add, or delete access to data, or cause a partial service failure.

The vulnerability of the Enterprise Manager Install component of the Enterprise Manager Base Platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to read, modify, add, or delete data, or cause...

CVE-2022-35293

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

The vulnerability of the SAP Business Objects Business Intelligence Platform, related to improper authorization, allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the SAP Business Objects Business Intelligence Platform is related to improper authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to modify, add, or delete data...

The vulnerability of the Filesystem component in Oracle Solaris allows a perpetrator to gain access to read, modify, or delete data, or to cause a service failure.

The vulnerability of the Filesystem component in Oracle Solaris relates to insecure management of privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read, modify, or delete access to data, or cause service failures...

OpenJDK: URI parsing inconsistencies (JNDI, 8278972)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JNDI. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

The vulnerability of the TLS and SSL protocols used by Cisco Nexus Dashboard for analyzing and automating cloud network operations stems from errors in the certificate validation process. This allows attackers to access confidential information or alter data.

The vulnerability of the TLS and SSL protocols used in Cisco Nexus Dashboard, a platform for analytics and automation of cloud network operations, is related to errors in the certificate validation process. Exploiting this vulnerability can allow an attacker to gain access to confidential...

OpenJDK: random exponentials issue (Libraries, 8283875)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: random exponentials issue (Libraries, 8283875)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated...