568 matches found
The vulnerability of the Azure Site Recovery disaster recovery tool lies in the insufficient protection of registration data, allowing attackers to escalate their privileges.
The vulnerability of the Azure Site Recovery recovery tool is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...
Data breaches leave customers very shaky, report says
Data breaches are one of the most reported cyberattacks against businesses—regardless of size and industry. And while this has highlighted cybersecurity gaps on so many fronts, some companies are still not prioritizing them as they should. Some have scrambled to be compliant but then find...
CVE-2022-0666
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11...
ZyXEL GS1900 操作系统命令注入漏洞
Zyxel ZyXEL GS1900 is a managed switch from Zyxel Taiwan, China. An Access Control Error vulnerability exists in multiple Zyxel products, which stems from the product's TFTP client not adding privilege controls to the functions that can execute system commands. The vulnerability can be exploited ...
Imperva Snapshot™ Scan: What You Can Find in the Report
Imperva Snapshot is a free AWS RDS security assessment tool. You can use this tool to gain in-depth visibility into your data and get a deep understanding about what data resides in your RDS and where your RDS database security gaps are. Acquiring this intelligence is a key element and critical...
The vulnerability of Microsoft Exchange Server servers stems from the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.
The vulnerability of Microsoft Exchange Server lies in the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created malicious link...
Xen 命令注入漏洞
Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. A command injection vulnerability exists ...
The vulnerability of the Windows Update Assistant’s software for handling updates leads to a lack of access control, allowing attackers to escalate their privileges.
The vulnerability of the Windows Update Assistant software relates to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...
Discovering the Exploitable Security Gaps in Remote Work Spaces
Unprotected smart devices that populate home offices are seen as low-hanging fruit by cybercriminals. These machines can be compromised and used in criminal campaigns or leveraged to gain deeper access to home networks...
PYSEC-2021-847
TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes...
PYSEC-2021-845
TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. The WordPress Plugin suffers from a cross-site scripting vulnerability that stems from the...
Ericsson Network Manager 跨站脚本漏洞
Ericsson Network Manager is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. Ericsson Network Manager suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-si...
Ditch the Alert Cannon: Modernizing IDS is a Security Must-Do
After more than 20 years of underwhelming results, security leaders have accepted their intrusion detection system IDS programs as no more than a compliance checkoff. It’s no secret that IDS’s reliance on bi-modal signatures is brittle, easily evaded and often referred to as an “alert cannon.” Ti...
CVE-2021-28701
Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...
The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium lies in insufficient testing for unusual or exceptional states. This allows a intruder to trigger malfunctions during maintenance.
The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium lies in insufficient testing for unusual or exceptional states. Exploiting this vulnerability can allow an attacker operati...
The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controllers lies in the insufficient checking of unusual or exceptional states. This allows a intruder to trigger a malfunction during maintenance.
The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controller is related to insufficient testing of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to cause malfunctions during maintenance operations...
The vulnerability in the implementation of the `chmod` command in the container runtime system, Containerd, allows a malicious actor to increase their privileges.
The vulnerability of the chmod command implementation in the container runtime system, Containerd, is related to deficiencies in the isolation of the controlled system area. Exploiting this vulnerability allows a remote attacker to increase their privileges...
The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of measures taken at the management level to clean up data. This allows attackers to execute arbitrary code.
The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the lack of measures taken to clean up data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
