Two actively exploited vulnerabilities affect multiple VMware products

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Multiple vulnerabilities have been discovered in VMware products. Two of these have been exploited in the wild. The first zero-day vulnerability, CVE-2022-22954, is a server-side template injection flaw. An attacker could...

Latest Update for Google Chrome Fixes Actively Exploited 0-day Flaw

By Waqas One of the two security vulnerabilities identified in the Google Chrome web browser was reportedly being actively exploited… This is a post from HackRead.com Read the original post: Latest Update for Google Chrome Fixes Actively Exploited 0-day Flaw...

CISA Adds Nine Known Exploited Vulnerabilities to Catalog

CISA has added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly add...

CSZ CMS SQL Injection Vulnerability (CNVD-2022-30780)

CSZ CMS is a PHP-based open source content management system CMS. cszcmsadminMembersviewUsers version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of externally entered SQL statements and can be exploited by attackers to execute illegal SQL commands t...

Microsoft Windows Hyper-V Remote Code Execution Vulnerability (CNVD-2022-74595)

Microsoft Windows Hyper-V is a tool from Microsoft Corporation that provides hardware virtualization. Microsoft Windows Hyper-V is vulnerable to a remote code execution vulnerability that could be exploited by attackers to execute arbitrary code on the system...

CSZ CMS SQL Injection Vulnerability (CNVD-2022-30779)

CSZ CMS is a PHP-based open source content management system CMS. CSZ CMS version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in cszcmsadminPluginmanagersetstatus, and can be exploited by attackers to execute illegal...

Dell PowerScale OneFS Denial of Service Vulnerability (CNVD-2022-32824)

Dell PowerScale OneFS is a PowerScale OneFS operating system that provides scale-out NAS. Dell PowerScale OneFS has a security vulnerability that could be exploited by an attacker to cause a denial of service...

CSZ CMS SQL Injection Vulnerability (CNVD-2022-30781)

CSZ CMS is a PHP-based open source content management system CMS. CSZ CMS version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in cszcmsadminMemberseditUser and can be exploited by attackers to execute illegal SQL...

SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2022-33129)

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces. SAP 3D Visual Enterprise Viewer version 9.0 is...

Cisco IOS XR SNMP Denial of Service Vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.Cisco IOS XE has a denial of service vulnerability that stems from an SNMP trap that causes a fatal error in Cisco IOS XE, which can be exploited by attackers to trigger a denial of service...

Cisco IOS XE NETCONF Over SSH Denial of Service Vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.A denial of service vulnerability exists in Cisco IOS XE NETCONF Over SSH, which can be exploited by attackers to cause a denial of service...

Microsoft Windows Kerberos Remote Code Execution Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A remote code execution vulnerability exists in Microsoft Windows Kerberos. The vulnerability stems from failure to properly process input data and can be exploited by an attacker to...

SAP NetWeaver Application Server权限提升漏洞

SAP NetWeaver Application Server is an application server from SAP Germany. SAP NetWeaver Application Server elevation of privilege vulnerability, which stems from a lack of authentication checks in the XML data archiving service, can be exploited by an attacker to cause an elevation of privilege...

Movie Seat Reservation System SQL Injection Vulnerability

Movie Seat Reservation System is a seat reservation system from an individual developer.Movie Seat Reservation System is vulnerable to SQL injection, which can be exploited by attackers to execute malicious SQL commands...

Microsoft Windows Secure Channel Denial of Service Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A denial of service vulnerability exists in Microsoft Windows Secure Channel. The vulnerability stems from a failure to properly handle incoming error messages and can be exploited by ...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2022-71765)

Microsoft HEVC Video Extensions is a video extension application from Microsoft USA. The application enables computers and devices to read High Efficiency Video Coding or HEVC videos. A remote code execution vulnerability exists in Microsoft HEVC Video Extensions, which can be exploited by an...

CVE-2021-43287

creationtimestamp| type| source ---|---|--- 2022-04-14 16:19:03+00:00| seen| https://t.me/cibsecurity/40760 2024-11-18 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-18 2025-01-15 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-15...

CVE-2014-9118

creationtimestamp| type| source ---|---|--- 2022-04-14 15:17:01+00:00| exploited| https://t.me/NeKaspersky/2117 2022-07-13 13:02:16+00:00| seen| MISP/8bf50bb8-94dd-4004-a646-5f78db6f0b6a 2024-11-30 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-30 2024-12-19...

CVE-2022-24816

creationtimestamp| type| source ---|---|--- 2022-04-14 00:18:15+00:00| seen| https://t.me/cibsecurity/40743 2024-06-26 18:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-11-08 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-08 2024-11-13...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...