QEMU Buffer Overflow Vulnerability (CNVD-2022-84156)

QEMU Quick Emulator is a set of emulation processor software by Fabrice Bellard, a French personal developer. The software is fast and cross-platform. QEMU suffers from a buffer overflow vulnerability that stems from a lack of validation of the input data size or length in the readerstrecord and...

Chocolatey PHP Permission Design Vulnerability

PHP is a scripting language that executes on the server side. A privilege design vulnerability exists in the Chocolatey PHP package v8.1.12 and below, which originates from all users in the Authenticated users group having write access to the subfolder C:\tools\php81 and all files in that folder,...

KLiK SocialMediaWebsite reply-form cross-site scripting vulnerability

KLiK SocialMediaWebsite is a simple PHP based social media website by Muhammad Saad personal developer. A cross-site scripting vulnerability exists in KLiK SocialMediaWebsite version 1.0.1 at reply-form. The vulnerability stems from a lack of effective filtering and escaping of user-supplied data...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

WAVLINK WN531G3 Access Control Error Vulnerability

The WAVLINK WN531G3 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN531G3 M31G3.V5030.201204 version and M31G3.V5030.200325 version contain an access control error vulnerability that can be exploited by an attacker to download configuration data and log files...

Google Chrome Live Caption Code Execution Vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome Live Caption, which can be exploited by attackers to execute arbitrary code on a system or cause a denial of service...

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a critical flaw impacting Oracle Fusion Middleware to its Known Exploited Vulnerabilities KEV Catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2021-35587, carries a CVSS score of 9.8 a...

Hirschmann BAT-C2 Command Injection Vulnerability

Hirschmann BAT-C2 is a wireless access point from Hirschmann Germany. A command injection vulnerability exists in versions prior to belden Hirschmann BAT-C2 09.13.01.00R04, which stems from a failure to adequately handle the dir parameter of the FsCreateDir Ajax function in the web server, and ca...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Note: To view the newly adde...

MOXA ARM-Based Computers Elevation of Privilege Vulnerability

MOXA ARM-Based Computers is a series of industrial computers from MOXA in China. An elevation of privilege vulnerability exists in Moxa ARM-Based Computers, which can be exploited by an attacker to gain root privileges...

Unspecified Vulnerability in AVEVA Edge

AVEVA Edge is a highly scalable and flexible HMI/SCADA software from AVEVA Software UK. A security vulnerability exists in AVEVA Edge 2020 R2 and prior versions that can be exploited by an attacker to potentially compromise the confidentiality, availability or integrity of the system. Details of...

Google Chrome < 107.0.5304.121 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 107.0.5304.121. It is, therefore, affected by a vulnerability as referenced in the 202211stable-channel-update-for-desktop24 advisory. - Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a...

Retired Software Exploited To Target Power Grids, Microsoft

By Habiba Rashid Boa was discontinued in 2005 but remained popular and is now becoming a crisis because of the complex nature of how it was built into the IoT device supply chain. This is a post from HackRead.com Read the original post: Retired Software Exploited To Target Power Grids, Microsoft...

Unspecified Vulnerability in WordPress Appointment Hour Booking plugin

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Karmasis Infraskope Agent Authentication Error Vulnerability

Karmasis Infraskope Agent is an application logger from Karmasis. An authentication error vulnerability exists in Karmasis Infraskope Agent versions prior to 7.10.00 that stems from improper authentication and can be exploited by an attacker to obtain sensitive information...

XWiki Platform 资源管理错误漏洞

XWik Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security error vulnerability exists in XWiki Platform. An attacker exploited the vulnerability to cause a degradation in database performance...

Simmeth System Supplier Manager SQL Injection Vulnerability

Simmeth System Supplier Manager is a supply chain software from Simmeth System GmbH, Germany.A SQL injection vulnerability exists in versions prior to Simmeth System GmbH Supplier Manager 5.6. The vulnerability stems from the application's lack of validation of externally entered SQL statements,...

Simmeth System Supplier Manager Arbitrary File Download Vulnerability

Simmeth System Supplier Manager is a supply chain software from Simmeth System, a German company, and an arbitrary file download vulnerability exists in versions prior to Simmeth System Supplier Manager 5.6, which can be exploited by attackers to download arbitrary files from a web server by...

CVE-2022-41840

creationtimestamp| type| source ---|---|--- 2022-11-18 22:29:34+00:00| seen| https://t.me/cibsecurity/53162 2025-05-10 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-05-10 2025-05-18 00:00:00+00:00| exploited| The Shadowserver...

HIGH: Vault or pool funds can be stolen by any user who holds LP tokens.

Lines of code Vulnerability details Description The distributeETHRewardsToUserForToken is implemented in SyndicateRewardsProcessor and used in derived contracts: GiantMevAndFeePool and StakingFundsVault. It sends out rewards to the given user according to the current accumulatedETHPerLPShare and...