Siemens RUGGEDCOM CROSSBOW SQL Injection Vulnerability

RUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP-compliant access to intelligent electronic devices.A SQL injection vulnerability exists in Siemens RUGGEDCOM CROSSBOW, which stems from the fact that the audit logs of affected applications are vulnerable to SQ...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-28105)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an information disclosure...

Microsoft Patch Tuesday, March 2023 Edition

Microsoft on Tuesday released updates to quash at least 74 security bugs in its Windows operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in Microsoft Outlook that can be exploited without any user interaction. The...

CVE-2023-20118

creationtimestamp| type| source ---|---|--- 2023-03-15 07:54:44+00:00| exploited| https://t.me/kasperskyb2b/516 2025-02-26 13:01:21+00:00| seen| MISP/bc6d9ead-717c-4bad-8e5d-c5b708f792f5 2025-02-27 08:20:00+00:00| seen| https://thehackernews.com/2025/02/polaredge-botnet-exploits-cisco-and.html...

Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities

Microsoft released its monthly security update Tuesday, disclosing 83 vulnerabilities across the companys hardware and software line, including two issues that are actively being exploited in the wild, continuing a trend of zero-days appearing in Patch Tuesdays over the past few months. Two of th...

Security Updates for Outlook (March 2023)

The Microsoft Outlook application installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

WordPress Solidres – Hotel booking plugin Plugin <= 0.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Solidres – Hotel booking plugin Type Plugin Vulnerable versions = 0.9.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1374 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2295c3bbe77d Credits Daniel...

Remote Code Execution (RCE)

firefox and thunderbird are vulnerable to Remote Code Execution RCE. An out of date graphics library likely contained vulnerabilities that could potentially be exploited to upload and execute malicious code on the system...

HashiCorp Vault 安全漏洞

HashiCorp Vault is a private key access management tool from HashiCorp USA. A security vulnerability exists in HashiCorp Vault and Vault Enterprise. An attacker exploited the vulnerability to destroy other user ids...

CVE-2022-1386

creationtimestamp| type| source ---|---|--- 2023-03-10 13:47:05+00:00| published-proof-of-concept| https://t.me/DailyToolz/660 2023-03-10 18:42:57+00:00| published-proof-of-concept| https://t.me/DailyToolz/658 2024-01-09 07:23:02+00:00| seen| https://t.me/arpsyndicate/2725 2025-01-26...

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center ASEC, in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on...

Lottery owner can rig the draw to win the jackpot by swapping the source

Lines of code Vulnerability details Lottery owner can rig the draw to win the jackpot by swapping the source Impact The lottery owner has the ability to swap the Random Source under certain cirumstances, and this can be exploited to set a new source contract that returns any number set by it. Thi...

CVE-2023-27482

creationtimestamp| type| source ---|---|--- 2023-03-08 20:23:21+00:00| seen| https://t.me/cibsecurity/59682 2024-10-30 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-10-30 2024-11-10 00:00:00+00:00| exploited| The Shadowserver...

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2022-35914 CVSS score: 9.8 - Teclib GLPI Remote Code Execution...

Cisco Finesse Denial of Service Vulnerability

Cisco Finesse is a set of call center management software from the U.S. company Cisco Cisco. Cisco Finesse suffers from a denial of service vulnerability that stems from incorrect IP address filtering by the reverse proxy, which can be exploited by an attacker to cause a denial of service DoS...

VMware NSX Manager vulnerabilities being actively exploited in the wild

The Wallarm Detect team has found exploit attempts in the wild of CVE-2022-31678 and CVE-2021-39144. The original vulnerabilities were found in VMware NSX Manager at the end of last year, and can lead to remote code execution RCE by pre-authenticated attackers. The CVE-2022-31678 vulnerability wa...

Mozilla Thunderbird and Firefox Arbitrary Code Execution Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. An arbitrary code execution vulnerability exists in Mozilla Thunderbird versions prior to...

CISA Known Exploited Vulnerability Catalog February 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary For a detailed CISAs KEV Catalog, download the pdf file here The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included ...

CVE-2023-0656

creationtimestamp| type| source ---|---|--- 2023-03-03 00:44:38+00:00| seen| https://t.me/cibsecurity/59348 2023-03-06 13:00:08+00:00| seen| https://t.me/truesecator/4134 2023-04-05 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8061 2024-01-16 10:54:08+00:00|...

WordPress CPO Content Types Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software CPO Content Types Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25451 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1449c76ab8ca Credits Rio Darmawan Required...