7000 matches found
ZZCMS Access Control Error Vulnerability
ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS suffers from an access control error vulnerability that stems from an incorrect access control vulnerability in zzcms via admin.php, which can be exploited by an attacker to directly access the administrator console afte...
Gryphon Tower Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...
Cross site scripting
Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Comment Engine Pro plugin versions = 1.0, could be exploited by users with Editor or higher role...
CVE-2021-44228
creationtimestamp| type| source ---|---|--- 2021-12-10 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=700 2021-12-10 08:54:02+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus38/2021 2021-12-10 09:44:22+00:00| exploited| https://t.me/poxek/229 2021-12-1...
CISA Adds 13 Known Exploited Vulnerabilities to Catalog
CISA has added 13 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and...
Jolokia Unauthorized Command Execution Vulnerability
Jolokia is a jmx remote management project implemented via http and josn. Jolokia unauthorized command execution vulnerability can be exploited by attackers to gain control of the server...
CISA Adds Thirteen Known Exploited Vulnerabilities to Catalog
CISA has added thirteen new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all typ...
SquaredUp for SCOM Cross-Site Scripting Vulnerability
Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. a cross-site scripting vulnerability exists in Image Tile in SquaredUp for SCOM version 5.2.1.6654, which can be exploited by remote attackers to inject arbitrary Web scripts or HTML...
CVE-2021-42567
creationtimestamp| type| source ---|---|--- 2021-12-08 00:23:19+00:00| seen| https://t.me/cibsecurity/33537 2025-01-01 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-01-01 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities -...
Electronic Team Donglify Integer Overflow Vulnerability
Electronic Team Donglify is an application from Electronic Team, Inc. that shares Usb security keys over the Internet. an integer overflow vulnerability exists in Electronic Team Donglify, which can be exploited by attackers to execute arbitrary code in kernel mode or via specially crafted I/O...
NoMachine Enterprise Client Buffer Overflow Vulnerability
NoMachine is a remote desktop access tool from Luxembourg-based NoMachine. A security vulnerability exists in NoMachine Enterprise Client, which can be exploited by attackers to execute arbitrary code in kernel mode or cause a denial of service memory corruption and OS crash via specially crafted...
PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise
The plugin does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any...
CVE-2021-43798
creationtimestamp| type| source ---|---|--- 2021-12-07 13:19:30+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/917 2021-12-07 15:48:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/918 2021-12-07 17:34:45+00:00| published-proof-of-concept|...
CVE-2021-40094
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...
Design/Logic Flaw
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...
CVE-2021-40094
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...
CVE-2021-24943
creationtimestamp| type| source ---|---|--- 2021-12-06 18:21:01+00:00| seen| https://t.me/cibsecurity/33388 2026-03-10 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-03-10 2026-06-14 00:00:00+00:00| exploited| The Shadowserver...
Several Zoho ManageEngine products have been exploited
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Multiple vulnerabilities have been discovered in Zoho ManageEngine products. The affected products include Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine SupportCenter Plus, Zoho ManageEngine Desktop Central, Zoho...
Victure WR1200 Trust Management Issue Vulnerability
Victure WR1200 is a router. A trust management issue vulnerability exists in Victure WR1200, which can be exploited by attackers to scan Wi-Fi networks for default keys...
Serva Server Remote Buffer Overflow Vulnerability
Vercot Serva is an automated Pxe server solution gas pedal based on an all-in-one portable multi-server engine from Vercot U.S. Serva is vulnerable to a server remote buffer overflow vulnerability that could be exploited by an attacker to cause a denial of service...