Microsoft Azure Security Vulnerabilities

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Azure HDInsights. An attacker exploited the vulnerability to perform spoofing attacks...

PT-2023-4225

Name of the Vulnerable Software and Affected Versions .NET and Visual Studio versions prior to the fixed version in August 2023 Patch Tuesday Description The issue is related to a Denial of Service DoS vulnerability in .NET and Visual Studio. It can be exploited for DoS attacks with no user...

2022's most routinely exploited vulnerabilities—history repeats

The Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, Federal Bureau of Investigation FBI, and international partners have released a joint Cybersecurity Advisory CSA called the 2022 Top Routinely Exploited Vulnerabilities. We went over the list and it felt like...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2017-18368 Zyxel P660HN-T1A Routers Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

CVE-2023-0425

ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make th...

Stack overflow

ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make th...

CVE-2023-0425 Buffer overflow in global memory region

ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make th...

ZKTeco BioTime Password Reset Vulnerability

ZKTeco BioTime is a powerful web-based time and attendance management software from ZKTeco, China. A password reset vulnerability exists in ZKTeco BioTime, which can be exploited by an attacker to arbitrarily reset the administrator's password via a crafted web request...

WordPress Photo Gallery by Ays Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Photo Gallery by Ays Type Plugin Vulnerable versions = 5.2.6 Fixed in 5.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-39917 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dcde53c55582 Credits Skalucy Requir...

Information Disclosure

nagvis is vulnerable to Information Disclosure. This vulnerability occurs when Nagvis parses a specially crafted URL that points to a file on the Nagvis server. If the file exists, Nagvis will read the contents of the file and display it in the web interface which can be exploited by an attacker ...

CVE-2023-4169

creationtimestamp| type| source ---|---|--- 2023-08-05 22:11:53+00:00| seen| https://t.me/cibsecurity/67815 2023-10-17 16:52:19+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5470 2023-10-20 11:06:20+00:00| seen| https://t.me/CyberSecurityTechnologies/9230 2023-10-22 17:46:15+00:00...

Remote code execution

PyroCMS 3.9 contains a remote code execution RCE vulnerability that can be exploited through a server-side template injection SSTI flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system...

Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities

A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022. "In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and...

2022 Top Routinely Exploited Vulnerabilities

SUMMARY The following cybersecurity agencies coauthored this joint Cybersecurity Advisory CSA: United States: The Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, and Federal Bureau of Investigation FBI Australia: Australian Signals Directorate’s Australian Cyb...

WordPress Duplicate Post Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Duplicate Post Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 80f37ad53409 Credits N/A Required privilege...

MotoCMS Code Execution Vulnerability

MotoCMS is a simple website builder from MotoCMS. A code execution vulnerability exists in MotoCMS that can be exploited by an attacker to execute arbitrary code on the system...

Mozilla Firefox and Firefox ESR Denial of Service Vulnerability (CNVD-2023-61753)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox ESR is Firefox Enterprise Edition. A denial of service vulnerability exists in Mozilla Firefox and Firefox ESR, which can be exploited by attackers to cause the browser to crash...

WordPress Simple Ticker Plugin <= 3.05 is vulnerable to Cross Site Scripting (XSS)

Software Simple Ticker Type Plugin Vulnerable versions = 3.05 Fixed in 3.06 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bbbc4c8f4c4a Credits Unknown Required privilege Contributor...

Ivanti patches second zero-day vulnerability being used in attacks

Ivanti has issued a patch to address a second critical zero-day vulnerability that is under active attack. The vulnerability is said to be used in combination with the first vulnerability we discussed some days ago. The Cybersecurity and Infrastructure Security Agency CISA has added the new...

CISA Known Exploited Vulnerability Catalog July 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...