CVE-2022-43605

An out-of-bounds write vulnerability exists in the SetAttributeList attributecountrequest functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote cod...

Null pointer dereference

A use-of-uninitialized-pointer vulnerability exists in the Forward Open connectionmanagemententry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially-crafted EtherNet/IP request can lead to use of a null pointer, causing the server to crash. An attacker can send a seri...

Out-of-bounds

An out-of-bounds write vulnerability exists in the GetAttributeList attributecountrequest functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out-of-bounds write, potentially causing the server to crash or allow for remote cod...

Out-of-bounds

An out-of-bounds write vulnerability exists in the SetAttributeList attributecountrequest functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote cod...

CVE-2022-43605

The CVE-2022-43605 issue affects EIP Stack Group OpENer (SetAttributeList attribute_count_request). A crafted EtherNet/IP request can trigger an out-of-bounds write in development commit 58ee13c, potentially crashing the server or enabling remote code execution. Talos’ report confirms the vulnera...

CVE-2022-43604

An out-of-bounds write vulnerability exists in the GetAttributeList attributecountrequest functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out-of-bounds write, potentially causing the server to crash or allow for remote cod...

CVE-2022-43604

Summary: CVE-2022-43604 affects the OpENer EtherNet/IP stack (EIP Stack Group), specifically the GetAttributeList attribute_count_request handling. When a GetAttributeList request carries an attribute_count_request value, the code uses it to drive a loop that writes response data. If attribute_co...

CVE-2022-43605

An out-of-bounds write vulnerability exists in the SetAttributeList attributecountrequest functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote cod...

CVE-2022-43606

A use-of-uninitialized-pointer vulnerability exists in the Forward Open connectionmanagemententry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially-crafted EtherNet/IP request can lead to use of a null pointer, causing the server to crash. An attacker can send a seri...

CVE-2022-43606

Summary (CVE-2022-43606) : In EIP Stack Group OpENer (development commit 58ee13c), a use-of-uninitialized-pointer occurs in the Forward Open connection_management_entry, when processing a specially crafted EtherNet/IP request. This can lead to a crash (server segmentation fault) due to dereferenc...

plymouthpsychgroup.com Cross Site Scripting vulnerability OBB-3224272

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Two US Citizens Charged for Hacking into DEA Portal in 2022

By Deeba Ahmed Both suspects, Sagar Steven Singh and Nicholas Ceraolo, were reportedly members of a notorious cybercrime group, ViLE. Two… This is a post from HackRead.com Read the original post: Two US Citizens Charged for Hacking into DEA Portal in 2022...

PT-2023-21303 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.106 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the rank parameter in the "/dede/group store.php" endpoint. Recommendations: For DedeCMS version 5.7.106, consider restricting...

CVE-2023-27059

A cross-site scripting XSS vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field...

PT-2023-20920 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: A cross-site scripting XSS issue in the Edit Group function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field. This enables...

CVE-2023-27059

A cross-site scripting XSS vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field...

CVE-2023-27059

ChurchCRM v4.5.3 is affected by a cross-site scripting (XSS) vulnerability in the Edit Group function, where an attacker can inject arbitrary scripts or HTML via the Edit Group Name field. The issue affects the Edit Group Name input and is supported by multiple sources in the Connected documents,...

CVE-2023-27059

A cross-site scripting XSS vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field...

PT-2023-14268 · Unknown · Eip Stack Group Opener

Name of the Vulnerable Software and Affected Versions: EIP Stack Group OpENer development commit 58ee13c Description: An out-of-bounds write issue exists in the GetAttributeList attribute count request functionality. A specially crafted EtherNet/IP request can lead to an out-of-bounds write,...

YoroTrooper Stealing Credentials and Information from Government and Energy Organizations

A previously undocumented threat actor dubbed YoroTrooper has been targeting government, energy, and international organizations across Europe as part of a cyber espionage campaign that has been active since at least June 2022. "Information stolen from successful compromises include credentials...