4-Year-Old Microsoft Azure Zero-Day Exposes Web App Source Code

The Microsoft Azure App Service has a four-year-old vulnerability that could reveal the source code of web apps written in PHP, Python, Ruby or Node, researchers said, that were deployed using Local Git. The bug has almost certainly been exploited in the wild as a zero-day, according to an analys...

OPMS Cross-site Request Forgery Vulnerability

OPMS is an OA management system. v1.3 and previous versions of OPMS contain a security vulnerability that can be exploited to add arbitrary user accounts via /user/add...

Dalmark Systems Systeam Security Vulnerability

Dalmark Systems Systeam is an Erp system from Dalmark Systems, a Brazilian company. version 2.22.8 build 1724 of Dalmark Systems Systeam contains a security vulnerability that could be exploited by an attacker to brute-force a valid user...

mySCADA myPRO Authentication Bypass Vulnerability

mySCADA myPRO is an HMI/SCADA system designed primarily for the visualization and control of industrial processes. An authentication bypass vulnerability exists in mySCADA myPRO, which can be exploited by an attacker to access the application without any form of authentication or authorization...

Fresenius Kabi Agilia Connect Infusion System has an unspecified vulnerability

Fresenius Kabi Agilia Connect Infusion System is an infusion system from the German company Fresenius Kabi.A security vulnerability exists in the Fresenius Kabi Agilia Connect Infusion System, which could be exploited by an attacker to emulate a user to manipulate RabbitMQ queues and messages...

Apache Archiva < 2.2.6 Multiple Log4j Vulnerabilities (Log4Shell) - Version Check

Apache Archiva is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tika 2.x < 2.2.0 Log4j RCE Vulnerability (Log4Shell)

Apache Tika is prone to a remote code execution RCE vulnerability in the Apache Log4j library dubbed SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Google Android Information Disclosure Vulnerability (CNVD-2021-101957)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android has an information disclosure vulnerability that can be exploited by attackers to cause local information disclosure without additional execution privileges...

CVE-2021-44790

creationtimestamp| type| source ---|---|--- 2021-12-20 14:39:58+00:00| seen| https://t.me/cibsecurity/34272 2021-12-23 17:49:44+00:00| seen| https://t.me/poxek/322 2021-12-28 16:00:47+00:00| seen| https://t.me/truesecator/2485 2022-01-25 20:42:22+00:00| published-proof-of-concept|...

Apache JSPWiki 2.11.0 Log4j RCE Vulnerability (Log4Shell) - Active Check

Apache JSPWiki is prone to a remote code execution RCE vulnerability in the Apache Log4j library dubbed SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2022-59689)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. Microsoft HEVC Video Extensions is a remote code execution vulnerability that can be exploited by attackers to execute arbitrary code on a system...

WordPress Temporary Login Without Password plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress Temporary Login Without Password plugin...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALAS-2021-001) (deprecated)

This plugin has been deprecated following detection of an issue with overlapping filenames. Deprecated by al2ALASCORRETTO8-2021-001.nasl plugin ID 160410 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory...

Threat Intelligence on Log4j CVE: Key Findings and Their Implications

Continuing with our research into CVE-2021-44228, Akamai has previously written about what the vulnerability is and given recommendations on how to go beyond patching for extra protection. Across the Akamai network, we see traffic from 1.3 billion unique devices daily, with record traffic of 182...

Adobe Experience Manager Code Issue Vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. Adobe...

QNAP Kazoo Server Cross-Site Scripting Vulnerability

Qnap Kazoo Server is a server from China Welllink Technology Qnap. QNAP Kazoo Server suffers from a cross-site scripting vulnerability, which can be exploited by attackers to inject malicious code...

Apache Log4j 2.0.x Multiple Vulnerabilities (Windows, Log4Shell) - Version Check

Apache Log4j is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:log4j"; ifdescription...

CVE-2021-42550

creationtimestamp| type| source ---|---|--- 2021-12-16 22:36:14+00:00| seen| https://t.me/cibsecurity/34169 2022-01-03 05:49:38+00:00| exploited| Telegram/QbzltGTL5MLooH2kEl1qS06h23oJX4UpKYkbnKcssYleTA...

More Log4j News

Log4j is being exploited by all sorts of attackers, all over the Internet: At that point it was reported that there were over 100 attempts to exploit the vulnerability every minute. "Since we started to implement our protection we prevented over 1,272,000 attempts to allocate the vulnerability,...

Microsoft released patch for actively exploited spoofing vulnerability

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. Microsoft AppX has a spoofing vulnerability that has been assigned CVE-2021-43890. Attackers are taking advantage of this critical vulnerability by deploying well-known malwares such as Emotet, Trickbot, and Bazaloader. Thi...