U.S. Federal Agencies Ordered to Patch Hundreds of Actively Exploited Flaws

The U.S. Cybersecurity and Infrastructure Security Agency CISA has published a catalog of vulnerabilities, including from Apple, Cisco, Microsoft, and Google, that have known exploits and are being actively exploited by malicious cyber actors, in addition to requiring federal agencies to prioriti...

Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120 Encryption Error Vulnerability

The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is a portable cardiac rhythm management Crm programming system from Boston Scientific, Inc. The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is vulnerable to an encryption error that could...

Huawei Emui and Magic UI Remote DoS Vulnerability (CNVD-2021-84859)

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI have a security vulnerability that could be exploited by attackers to cause the application to exit unexpectedly...

CISA sets two week window for patching serious vulnerabilities

The Cybersecurity and Infrastructure Security Agency CISA has issued binding directive 22-01 titled Reducing the Significant Risk of Known Exploited Vulnerabilities. This directive applies to all software and hardware found on federal information systems managed on agency premises or hosted by...

CVE-2021-26294

creationtimestamp| type| source ---|---|--- 2021-11-04 14:51:10+00:00| published-proof-of-concept| Telegram/E904-7tNY5SsCugfjArkkhd1hZWJs7UA85Xzgg7k4dhsQ 2022-01-11 11:05:12+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5174 2023-11-30 07:58:47+00:00| seen|...

Sourcecodester Simple Subscription Website SQL Injection Vulnerability

Simple Subscription Website is a web-based application. SourceCodester Simple Subscription Website 1.0 is vulnerable to SQL injection, which can be exploited by attackers to perform SQL injection via login...

ZOHO ManageEngine Log360 Access Control Error Vulnerability

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.ZOHO ManageEngi...

SourceCodester Simple Subscription Website Cross-Site Scripting Vulnerability

SourceCodester Simple Subscription Website is a web-based application. sourceCodester Simple Subscription Website 1.0 is vulnerable to cross-site scripting, which can be exploited by attackers to execute cross-site scripting via the plan application's id parameter to execute cross-site scripting...

CVE-2021-38499

Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 93...

CISA Issues BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

CISA has issued Binding Operational Directive BOD 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities, to establish specific timeframes for federal civilian agencies to remediate vulnerabilities that are being actively exploited by known adversaries. To support this Directive,...

Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

Accellion FTA contains a server-side request forgery SSRF vulnerability exploited via a crafted POST request to wmProgressstat.html...

Alert! Hackers Exploiting GitLab Unauthenticated RCE Flaw in the Wild

A now-patched critical remote code execution RCE vulnerability in GitLab's web interface has been detected as actively exploited in the wild, cybersecurity researchers warn, rendering a large number of internet-facing GitLab instances susceptible to attacks. Tracked as CVE-2021-22205, the issue...

Google Android System Information Disclosure Vulnerability (CNVD-2021-101430)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA for short.The System component of Google Android versions 9, 10, 11, and 12 is vulnerable to information disclosure, which could be exploited by attackers to cause local information...

Online Reviewer System Remote Code Execution Vulnerability

Online Reviewer System is an application. Online Reviewer System version 1.0 contains a remote code execution vulnerability that could be exploited by attackers to bypass image upload filters and upload maliciously crafted PHP files...

Google Android Kernel Component Elevation of Privilege Vulnerability (CNVD-2021-101428)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. an elevation of privilege vulnerability exists in the Google Android Kernel component Kernel, which could be exploited by an attacker to cause a local elevation of privilege that...

Google Android Kernel Component Elevation of Privilege Vulnerability (CNVD-2021-101426)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. an elevation of privilege vulnerability exists in the Google Android Kernel component ION, which could be exploited by an attacker to cause a local elevation of privilege without...

Google Android System Denial of Service Vulnerability (CNVD-2021-101429)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. a denial-of-service vulnerability exists in the System component of Google Android versions 9, 10 and 11, which could be exploited by attackers to cause a denial of service...

Nvidia vGPU Software Resource Management Error Vulnerability

Nvidia vGPU Software is a management software from Nvidia Corporation for providing GPU capabilities to virtual machines. NVIDIA vGPU software is vulnerable to a resource management error that could be exploited by attackers to execute arbitrary code that affects integrity and availability...

IBM InfoSphere Information Server Cross-Site Request Forgery Vulnerability (CNVD-2021-84239)

IBM InfoSphere Information Server is a data integration platform from IBM Corporation. A security vulnerability exists in IBM InfoSphere Information Server, which stems from the vulnerability of IBM InfoSphere Information Server to cross-site request forgery, which could be exploited by an attack...

GitLab Unauthenticated Remote Code Execution CVE-2021-22205 Exploited in the Wild

CVE | Vendor Advisory | AttackerKB | IVM Content | Patching Urgency | Last Update ---|---|---|---|---|--- CVE-2021-22205 | GitLab Advisory | AttackerKB | Evaluating | ASAP | November 1, 2021 On April 14, 2021, GitLab published a security release to address CVE-2021-22205, a critical remote code...