7101 matches found
Apple Issues Patches for 2 Actively Exploited Zero-Days in iPhone, iPad and Mac Devices
Apple on Thursday rolled out emergency patches to address two zero-day flaws in its mobile and desktop operating systems that it said may have been exploited in the wild. The shortcomings have been fixed as part of updates to iOS and iPadOS 15.4.1, macOS Monterey 12.3.1, tvOS 15.4.1, and watchOS...
Trend Micro Antivirus for Mac Elevation of Privilege Vulnerability (CNVD-2022-55061)
Trend Micro Antivirus for Mac is a Mac-based antivirus software from Trend Micro, Inc. An elevation of privilege vulnerability exists in Trend Micro Antivirus for Mac version 11.5, which could be exploited to create a specially crafted file as a symbol that could lead to elevation of privilege li...
Google Go Denial of Service Vulnerability (CNVD-2022-55062)
Google Go is a statically strongly typed, compiled, concurrent, and garbage collected programming language from Google, Inc. A denial of service vulnerability exists in Google Go that could be exploited to cause a denial of service in client applications...
Google Android Elevation of Privilege Vulnerability (CNVD-2022-42147)
Google Android is a Linux-based open-source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from a lack of privilege checks in CellBroadcastReceiver, and there may be a path to enable specific cellular features that could be exploit...
TotoLink EX300_v2 Cross-Site Scripting Vulnerability
TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink China. version TotoLink EX300v2 V4.0.3c.140B20210429 has a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...
Google Android Elevation of Privilege Vulnerability (CNVD-2022-43861)
Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from a vulnerability in ConnectedDevicesSliceProvider.java.java's createGeneralSlice, PendingIntent bypasses privileges and can be exploited...
Spring Cloud Function SpEL Injection (CVE-2022-22963) Exploited in the Wild
Although Spring Cloud Functions are not as widespread as the Log4j library, and should provide a good separation from the hosting server, some draw the line between the two, due to the ease of exploitation over HTTP/s. This new vulnerability will definitely result in many threat actors launching...
CVE-2022-22965
creationtimestamp| type| source ---|---|--- 2022-03-31 13:45:50+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1756 2022-03-31 14:20:55+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1757 2022-03-31 14:38:31+00:00| published-proof-of-concept|...
Jenkins Tests Selector Plugin Arbitrary File Read Vulnerability
Jenkins and Jenkins Plugin are both open source products from Jenkins.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Tests Selector Plugin 1.3.3 a...
Wordpress Plugin All-in-one Floating Contact Form Cross-Site Scripting Vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...
CSZ CMS SQL Injection Vulnerability (CNVD-2022-30782)
CSZ CMS is a PHP-based open-source content management system CMS.A SQL injection vulnerability exists in CSZ CMS 1.2.9, which can be exploited by attackers via cszcms/controllers/Member.php...
Vmware Spring Framework Denial of Service Vulnerability
Vmware Spring Framework is a set of open source Java, JavaEE application framework from Vmware USA. The framework helps developers build high-quality applications.Vmware Spring Framework has a denial-of-service vulnerability that can be exploited by attackers to cause a denial of service via a...
CVE-2022-22274
creationtimestamp| type| source ---|---|--- 2022-03-29 11:35:50+00:00| seen| https://t.me/truesecator/2781 2022-03-29 12:52:24+00:00| seen| https://t.me/informationsecuritychannel/46999 2023-01-15 14:05:50+00:00| published-proof-of-concept| https://t.me/crackcodes/2272 2024-01-16 10:54:08+00:00|...
NETGEAR R8500 Command Injection Vulnerability
The NETGEAR R8500 is a wireless router from the American company Netgear. A security vulnerability exists in the NETGEAR R8500, which can be exploited by an attacker to execute arbitrary commands e.g. telnetd via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters of...
Directory traversal
An Archive Extraction AKA "Zip Slip vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal...
Analyzing the Attack Landscape: Rapid7’s 2021 Vulnerability Intelligence Report
Every year, our research team at Rapid7 analyzes thousands of vulnerabilities to understand root causes, dispel misconceptions, and explain why some flaws are more likely to be exploited than others. By continuously reviewing the vulnerability landscape and sharing our research team’s insights, w...
Covid-19 Directory On Vaccination System 1.0 SQL Injection
Exploit Title: Covid-19 Directory on Vaccination System 1.0 - SQLi Authentication Bypass Date: 28/03/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
CISA Adds 32 Known Exploited Vulnerabilities to Catalog
CISA has added 32 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...
