2021 Top Routinely Exploited Vulnerabilities

CISA, the National Security Agency NSA, the Federal Bureau of Investigation FBI, the Australian Cyber Security Centre ACSC, the Canadian Centre for Cyber Security CCCS, the New Zealand National Cyber Security Centre NZ NCSC, and the United Kingdom’s National Cyber Security Centre NCSC-UK have...

WordPress English WordPress Admin plugin重定向漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress English WordPress Admin plugin version 1.5.2 has a redirect vulnerability, which can be...

IBM Planning Analytics Arbitrary File Upload Vulnerability

IBM Planning Analytics is a business planning and analysis solution from IBM Corporation in the United States. IBM Planning Analytics has an arbitrary file upload vulnerability that can be exploited to upload arbitrary executable files, leading to code execution...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2022-34987)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. IBM QRadar SIEM...

IBM Cognos Analytics Information Disclosure Vulnerability (CNVD-2022-34804)

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation. The software includes reports, dashboards and scorecards, and can help companies adjust their decisions by analyzing key factors and key people, etc. IBM Cognos Analytics has an information disclosure...

ASUS WebStorage Android Security Bypass Vulnerability

ASUS WebStorage is an online storage service from ASUS China.A security vulnerability exists in ASUS WebStorage Android, which could be exploited by attackers to log into a regular user account to access, modify, or delete user account information...

CVE-2022-29078

creationtimestamp| type| source ---|---|--- 2022-04-25 18:36:10+00:00| seen| https://t.me/cibsecurity/41385 2022-07-19 10:13:43+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/6378 2022-07-19 12:12:47+00:00| published-proof-of-concept|...

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Accusoft ImageGear heap buffer overflow vulnerability (CNVD-2022-35414)

Accusoft ImageGear is a software development kit SDK for image processing from Accusoft, USA. A security vulnerability exists in Accusoft ImageGear, which can be exploited by an attacker to pass crafted data to an application, trigger a heap buffer overflow, and execute arbitrary code on the targ...

Simple Real Estate Portal System SQL注入漏洞（CNVD-2022-43405）

Simple Real Estate Portal System is a real estate portal system from Carlo Montero's personal developer. version v1.0 of Simple Real Estate Portal System is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Attendance and Payroll System SQL注入漏洞（CNVD-2022-33148）

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component admincashadvancedelete.php lacks validation for external...

CVE-2022-1427 Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mruby

Out-of-bounds Read in mrbobjiskindof in in GitHub repository mruby/mruby prior to 3.2. Impact: Possible arbitrary code execution if being exploited...

CVE-2022-1427 Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mruby

Out-of-bounds Read in mrbobjiskindof in in GitHub repository mruby/mruby prior to 3.2. Impact: Possible arbitrary code execution if being exploited...

CVE-2022-1427

Out-of-bounds Read in mrbobjiskindof in in GitHub repository mruby/mruby prior to 3.2. Impact: Possible arbitrary code execution if being exploited...

CVE-2022-1439

creationtimestamp| type| source ---|---|--- 2022-04-22 20:28:04+00:00| seen| https://t.me/cibsecurity/41333 2024-11-24 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-11-24 2025-02-05 00:00:00+00:00| exploited| The Shadowserver...

Skeletons in the Closet: Security 101 Takes a Backseat to 0-days

Rarely a month goes by without the infosec industry being plagued by a new zero-day apocalypse. Most recently in December 2021, the world was swept by a series of vulnerabilities in Log4J – a popular logging system used by thousands of systems around the world. While writing this article, the...

Google Android Information Disclosure Vulnerability (CNVD-2022-32847)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android elevation of privilege vulnerability (CNVD-2022-32841)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to escalate privileges...

Google Android Security Bypass Vulnerability (CNVD-2022-32845)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to arbitrarily modify and set system properties...

Kyocera d-COLOR MF3555 Cross-Site Scripting Vulnerability

Kyocera d-COLOR MF3555 is a color multifunction printer from Kyocera Japan.A cross-site scripting vulnerability exists in the Kyocera d-COLOR MF3555 2XDS000.002.271 device, which stems from a web application not properly checking parameters before saving them to the server, and can be exploited b...