PT-2022-17976

Name of the Vulnerable Software and Affected Versions Online Banking System Protect version 1.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are accessible via parameters on the user profile, system info, and accounts management pages...

CVE-2022-28145

creationtimestamp| type| source ---|---|--- 2022-03-29 16:41:13+00:00| seen| https://t.me/cibsecurity/39726...

PT-2025-8199

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, specifically in the smb2 ioctl query info function. When this function is called with certain parameters, such as smb query...

PT-2025-8010

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc8+ Description A use-after-free issue has been identified in the Linux kernel, specifically in the mpt3sas driver. The function mpt3sas transport port remove frees the port field of the sas expander...

PT-2022-37900

Уязвимость функции smb2 ioctl query info модуля fs/cifs/smb2ops.c поддержки файловой системы ядра операционной системы Linux связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2022-26980

Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...

PT-2022-18159

Name of the Vulnerable Software and Affected Versions Teampass version 2.1.26 Description The issue allows for reflected XSS via the "index.php" PATH INFO. This can be exploited when someone opens a link to the Teampass Password Manager index page that contains a malicious payload. Recommendation...

Teampass Cross-Site Script Vulnerability

TeamPass is an open source password manager from the individual developer NILS LAUMAILLÉ Nils Laumaillé. A security vulnerability exists in Teampass 2.1.26, which can be exploited by an attacker via index.php PATHINFO...

VulnCheck KEV: CVE-2015-3035

Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. dot dot in the PATHINFO to login/...

CVE-2021-4203

A use-after-free read flaw was found in sockgetsockopt in net/core/sock.c due to SOPEERCRED and SOPEERGROUPS race with listen and connect in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information...

Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution...

CVE-2022-26249

Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack...

CVE-2022-27082

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

CVE-2022-27082

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

CVE-2022-27081

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo...

CVE-2022-24291

CVE-2022-24291 affects Certain HP Print devices, enabling potential information disclosure, denial of service, or remote code execution. Public sources in the connected set confirm HP printer families and models are affected and note a firmware remediation path. HP’s advisory HPSBPI03781 document...

CVE-2022-0861

creationtimestamp| type| source ---|---|--- 2022-03-23 17:28:41+00:00| seen| https://t.me/cibsecurity/39411...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

Unconstrained Delegation

Microsoft to support scenarios where users authenticate via Kerberos to one system and information needs to be updated on another system implemented unconstrained delegation. This… Continue reading - Unconstrained Delegation...

Rocket.Chat: Rocket.chat user info security issue

Hello, We have find potential security issue that user with “view-full-other-user-info” permissions is able to view another user's OAuth tokens via Rest API. Tested on Rocket.Chat version 4.3.3 Steps to reproduce: 1. Integration with OAuth 2.0 identity provider e.g. Keycloak is required 1. Add ro...