6934 matches found
VMware Spring Cloud Gateway 3.0 < 3.0.7 / 3.1 < 3.1.1 Code Injection
The version of Spring Cloud Gateway running on the remote host is affected by a code injection vulnerability. Applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request tha...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: To view the newly added...
Double free
SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnerability which is exploited via crafted TCP packets...
IBM Security Verify Information Queue Information Disclosure Vulnerability (CNVD-2022-55635)
IBM Security Verify Information Queue is an integration product from IBM of America, Inc. Leverages Kafka technology and a publish/subscribe model to integrate data between IBM Security products. IBM Security Verify Information Queue version 10.0.2 is vulnerable to an information disclosure...
WordPress Sygnoos Popup Builder Cross-Site Request Forgery Vulnerability
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Sygnoos Popup Builder 4.1.11 and prior versions, which arises from a web applicatio...
CVE-2022-35653
creationtimestamp| type| source ---|---|--- 2022-07-25 20:33:13+00:00| seen| https://t.me/cibsecurity/46937 2023-11-17 04:55:23+00:00| seen| https://t.me/arpsyndicate/203 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-02-04 00:00:00+00:00|...
CVE-2021-40335 Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product
A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...
Critical Vulnerabilities in Multiple Atlassian Products being exploited-in-wild
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Atlassian has released patches to address a critical security flaw, being tracked as CVE-2022-26138 involving the usage of hard-coded credentials in the Questions For Confluence app for Confluence Server...
Duplicate Advisory GHSA-hrgx-p36p-89q4
Duplicate Advisory This advisory is a duplicate of GHSA-hrgx-p36p-89q4. This link is maintained to preserve external references. Original Description PrestaShop 1.6.0.10 through 1.7.x before 1.7.8.2 allows remote attackers to execute arbitrary code, aka a "previously unknown vulnerability chain"...
Oracle MySQL Server Denial of Service Vulnerability (CNVD-2022-54319)
Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server 8.0.28 and earlier versions have a denial-of-service vulnerability in the Server: Optimizer component, which can be exploited by attackers to cause MySQL Server to hang or crash...
Oracle MySQL Server Denial of Service Vulnerability (CNVD-2022-54318)
Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server 8.0.28 and earlier versions have a denial-of-service vulnerability in the Server: Optimizer component, which can be exploited by attackers to cause MySQL Server to hang or crash...
SAP NetWeaver Enterprise Portal Cross-Site Scripting Vulnerability (CNVD-2022-56941)
SAP NetWeaver Enterprise Portal is a web front-end component of SAP NetWeaver. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by attackers to view or modify information...
Microsoft Office Most Exploited Software in Malware Attacks – Report
By Deeba Ahmed Research reveals that around 80% of all malware attacks used MS Office flaws. Atlas VPN has shared its… This is a post from HackRead.com Read the original post: Microsoft Office Most Exploited Software in Malware Attacks - Report...
Atlassian Rolls Out Security Patch for Critical Confluence Vulnerability
Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affecting the Questions For Confluence app for Confluence Server and Confluence Data Center. The flaw, tracked as CVE-2022-26138, arises when the app in question is enable...
Oracle MySQL Server InnoDB Component Denial of Service Vulnerability
Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Server is one of the database server components, and a denial-of-service vulnerability exists in Oracle MySQL 8.0.29 and earlier versions, which stems from the presence of The vulnerability is caus...
Oracle Virtualization Input Validation Error Vulnerability (CNVD-2023-08447)
Oracle Virtualization is a virtualization solution from Oracle Corporation. It is used to unify and manage the entire hardware and software architecture from the application to the disk. Oracle Virtualization has a security vulnerability that could be exploited by an attacker to cause Oracle VM...
Vulnerabilities & Threats that Matter 11-17 July 2022
Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 580 37 2 World-wide 11 61 For a detailed threat digest, download the pdf file here Summary The second week of July 2022 witnessed the discovery of 580 vulnerabilities out ...
CVE-2022-35405
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. This also affects ManageEngine Access Manager Plus before 4303 with authentication. Recent assessments: gwillcox-r7 at October 25, 2022 5:15pm UTC reported: This was...
Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features
Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Trellix · July 19, 2022 This blog was also written by Chintan Shah Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned...