Microsoft SharePoint 输入验证错误漏洞

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. Microsoft SharePoint ...

CVE-2020-23967

Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYSTEM due to insufficient control during autoupdate...

Microsoft Exchange Cyber Attack — What Do We Know So Far?

Microsoft on Friday warned of active attacks exploiting unpatched Exchange Servers carried out by multiple threat actors, as the hacking campaign is believed to have infected tens of thousands of businesses, government entities in the U.S., Asia, and Europe. The company said "it continues to see...

CVE-2020-28466 Denial of Service (DoS)

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...

CVE-2020-28466

CVE-2020-28466 affects the nats-server component at github.com/nats-io/nats-server/server. The issue arises from an export/import cycle between accounts that untrusted users can trigger, causing the server to crash (denial of service) by consuming CPU/memory. Connected advisories indicate the 2.x...

CVE-2021-26965

A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacke...

Huawei EulerOS: Security Advisory for dnsmasq (EulerOS-SA-2021-1389)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Extortion Gang Breaches Cybersecurity Firm Qualys Using Accellion Exploit

Enterprise cloud security firm Qualys has become the latest victim to join a long list of entities to have suffered a data breach after zero-day vulnerabilities in its Accellion File Transfer Appliance FTA server were exploited to steal sensitive business documents. As proof of access to the data...

CISA Issues Emergency Directive on In-the-Wild Microsoft Exchange Flaws

Following Microsoft's release of out-of-band patches to address multiple zero-day flaws in on-premises versions of Microsoft Exchange Server, the U.S. Cybersecurity and Infrastructure Security Agency CISA has issued an emergency directive warning of "active exploitation" of the vulnerabilities. T...

Patch now! Exchange servers attacked by Hafnium zero-days

Microsoft has detected multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft attributes the attacks to a group they have dubbed Hafnium. “HAFNIUM primarily targets entities in the United States across a number ...

Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails

Microsoft Corp. today released software updates to plug four security holes that attackers have been using to plunder email communications at companies that use its Exchange Server products. The company says all four flaws are being actively exploited as part of a complex attack chain deployed by...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details...

The vulnerability of the NX-OS operating system in ACI Mode allows a hacker to bypass security checks and connect an unauthorized server to the VLAN infrastructure.

The vulnerability of the NX-OS operating system in ACI Mode is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to bypass security checks and connect unauthorized servers to the VLAN infrastructure...

The vulnerability of the API component of the Cisco ACI Multi-Site Orchestrator (MSO) allows a attacker to modify the device’s configuration.

The vulnerability of the API component of the Cisco ACI Multi-Site Orchestrator MSO is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to modify the device’s configuration remotely...

The vulnerability of the Java framework’s LDAP module for securing Spring-based industrial applications allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the LDAP module of the Java framework for securing Spring-based industrial applications is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the NVIDIA Control Panel driver for graphics processors such as NVIDIA GeForce, Quadro, NVS, and Tesla for Windows operating systems allows a malicious individual to cause system failures or gain increased privileges.

The vulnerability of the NVIDIA Control Panel driver for graphics processors such as NVIDIA GeForce, Quadro, NVS, and Tesla on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to cause system failures or increase their...

Linkedin Oncall Cross-Site Scripting Vulnerability

Linkedin Oncall is the United States Linkedin company based on Python language can be used to manage the calendar planning platform of the building system. A security vulnerability exists in Linkedin Oncall versions 1.4.0 and earlier, which stems from the mishandling of the "No results found"...

Cisco Releases Security Patches for Critical Flaws Affecting its Products

Cisco has addressed a maximum severity vulnerability in its Application Centric Infrastructure ACI Multi-Site Orchestrator MSO that could allow an unauthenticated, remote attacker to bypass authentication on vulnerable devices. "An attacker could exploit this vulnerability by sending a crafted...

Daycare Webcam Service Exposes 12,000 User Accounts

NurseryCam, a webcam service used across 40 daycare centers in the U.K. by parents who want to keep a watchful eye on their babies, has shut down following a data breach. The breach exposed the personal data of about 12,000 users to an attacker who said he or she was trying to improve the service...

The vulnerability of the File System API interface in the Google Chrome web browser allows a hacker to circumvent existing security restrictions.

The vulnerability of the File System API interface in the Google Chrome web browser is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...