Dell Vnx2 Oe For File Elevation of Privilege Vulnerability

Dell Vnx2 Oe For File is an operating environment of Dell, Inc. A security vulnerability exists in Dell Vnx2 Oe For File versions 8.1.21.266 and earlier, which could be exploited by an attacker to conduct an attack and gain elevated privileges...

CISA Adds Eight Known Exploited Vulnerabilities to Catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-28910)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android has security vulnerabilities that can be exploited by attackers to submit special requests that can execute arbitrary code in the application context and elevate privileges...

Design/Logic Flaw

Out-of-bounds Read in mrbgetargs in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited...

ASUS RT-AC86U Command Injection Vulnerability

The ASUS RT-AC86U is a dual-band Wi-Fi router from the Chinese company ASUS. The ASUS RT-AC86U suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands and interrupt or terminate services...

Fortinet FortiEDR Denial of Service Vulnerability

Fortinet FortiEDR is a scratch-built endpoint security solution from Fortinet, U.S.A. A denial-of-service vulnerability exists in Fortinet FortiEDR versions 5.0.3 and earlier, which stems from a resource management error that could be exploited by an attacker to make an entire application...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-32816)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack 2022.1.43563 previously contained a security vulnerability that could be exploited by attackers to steal a victim's cookie-based authentication credentials...

Huawei HarmonyOS Business Logic Error Vulnerability (CNVD-2022-53579)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A business logic error vulnerability exists in the Huawei HarmonyOS communication module. The vulnerability stems from a business logic error in the...

HPE OneView Authentication Bypass Vulnerability

HPE OneView is a software from Hewlett Packard Enterprise HPE that facilitates automated device management for IT departments. versions prior to HPE OneView 6.6 contain an authentication bypass vulnerability that stems from insufficient program authentication strength and can be exploited by an...

Apache Pinot Denial of Service Vulnerability

Apache Pinot is a real-time distributed OLAP data store from the Apache Foundation, Inc. Designed to provide ultra-low latency analysis, Apache Pinot 0.9.3 and earlier versions contain a denial-of-service vulnerability that could be exploited by an attacker to cause a Pinot service outage via a...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Google Android Information Disclosure Vulnerability (CNVD-2022-26769)

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has a security vulnerability that could be exploited by attackers to gain access to sensitive information...

The Bug Report - March 2022 Edition

The Bug Report - March 2022 By Charles McFarland · April 6, 2022 Your Cybersecurity Comic Relief Comic from https://geek-and-poke.com/ and remains unedited. https://creativecommons.org/licenses/by/3.0/ Use of this comic does not indicate endorsement by the creator. Why am I here? Welcome back the...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly add...

MacOS SUHelper Root Privilege Escalation Vulnerability: A Deep Dive Into CVE-2022-22639

We discovered a now-patched vulnerability in macOS SUHelper, designated as CVE-2022-22639. If exploited, the vulnerability could allow malicious actors to gain root privilege escalation...

SonicWall Secure Remote Access (SRA) SQLi (SNWLID-2021-0017)

The remote host is a SonicWall Secure Remote Access SRA device that is affected by an SQL injection vulnerability due to improper neutralization of an SQL command. An unauthenticated, remote attacker can exploit this to run SQL commands. Note that Nessus has not tested for this issue but has...

Two Vulnerabilities affecting Apple macOS exploited-in-the-wild

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Two zero-day vulnerabilities were discovered in macOS Monterey versions prior to 12.3.1. These new issues bring the total number of zero-day vulnerabilities discovered in the Apple ecosystem to four. CVE-2022-22674 is an...

Security feature bypass

Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a remote, authenticated attacker to bypass FactoryTalk Security policies based on the computer name. If successfully exploited, this may all...

Update now! Apple patches two zero-day vulnerabilities that may have been actively exploited

Apple has released security updates for macOS Monterey 12.3.1, iOS 15.4.1, iPadOS 15.4.1, tvOS 15.4.1, and watchOS 8.5.1. The update patches two vulnerabilities about which the advisory states that Apple is aware of a report that this issue may have been actively exploited for both vulnerabilitie...

Zyxel Releases Patches for Critical Bug Affecting Business Firewall and VPN Devices

Networking equipment maker Zyxel has pushed security updates for a critical vulnerability affecting some of its business firewall and VPN products that could enable an attacker to take control of the devices. "An authentication bypass vulnerability caused by the lack of a proper access control...