Siemens SCALANCE X-200RNA Switch Devices Improper Encoding or Escaping of Output (CVE-2019-6109)

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The- Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...

Siemens SCALANCE X-200RNA Switch Devices Concurrent Execution Using Shared Resource with Improper Synchronization (CVE-2018-15473)

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. - OpenSSH through 7.7 is prone to a...

CVE-2023-0886

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-3411. Reason: This candidate is a reservation duplicate of CVE-2022-3411. Notes: All CVE users should reference CVE-2022-3411 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2022-41216

Technical details (affected product versions, root cause, impact, and fixes) are not publicly provided in the connected documents. Monitor for updates from vendors and security advisories.

Sales Tracker System 1.0 SQL Injection

Exploit Title: Authenticated SQL Injection on Sales Tracker System Google Dork: NA Date: 21/2/2023 Exploit Author: Ahmed Ismail @MrOz1l Vendor Homepage: https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.html Software Link: download link if availab...

Possible out-of-bounds read in release mode

Affected versions of this crate were using a debug assertion to validate the last parameter of partialsort. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions. All writes are bounds-checked, so the out-of-bounds...

Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine

Russia's cyber attacks against Ukraine surged by 250% in 2022 when compared to two years ago, Google's Threat Analysis Group TAG and Mandiant disclosed in a new joint report. The targeting, which coincided and has since persisted following the country's military invasion of Ukraine in February...

CVE-2021-32852

Countly countly-server (prior to 21.11, community edition) is vulnerable to cross-site scripting (XSS) via malicious links or redirects. An attacker must have or create an account, and successful exploitation results in script execution in the victim’s browser. The issue is patched in version 21....

CVE-2021-33237

The CVE-2021-33237 entry is a duplicate of CVE-2021-36686. Connected records provide concrete details for CVE-2021-36686: a Cross Site Scripting (XSS) vulnerability in the yapi project, reported for version 1.9.1, exploitable via the /interface/api edit page. The root cause is improper input hand...

CVE-2023-0822

CVE-2023-0822 affects Delta Electronics DIAEnergie prior to v1.9.03.001. The vulnerability is described as improper authorization that could allow an unauthorized user to bypass authorization and access privileged functionality. In the published advisories, the CVSS v3.1 base score is 8.8 (HIGH),...

CVE-2021-32419

CVE-2021-32419 affects Schism Tracker, specifically the vulnerability in the fmt_mtm_load_song function in fmt/mtm.c that could disclose sensitive information. The issue is described as present in Schism Tracker v20200412 and fixed in v20200412. Connected sources consistently reference an informa...

CVE-2023-20052

CVE-2023-20052 affects ClamAV DMG file parser in versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. An unauthenticated attacker could exploit XML external entity substitution to cause an information leak by submitting a crafted DMG file to be scanned, potentially leaking by...

CVE-2022-48325

Summary (CVE-2022-48325) : Multiple Cross Site Scripting (XSS) vulnerabilities affect Mapos 4.39.0, enabling arbitrary code execution per the cited entries. The flaws are linked to unsanitized user-controlled inputs across numerous parameters in Mapos/controllers (Mapos.php), Mine.php, and Os.php...

CVE-2023-0103

creationtimestamp| type| source ---|---|--- 2023-02-15 20:49:45+00:00| seen| https://t.me/cibsecurity/58255...

CVE-2023-25578

creationtimestamp| type| source ---|---|--- 2023-02-15 18:50:18+00:00| seen| https://t.me/cibsecurity/58243 2024-11-20 20:55:00+00:00| seen| https://infosec.exchange/users/cve/statuses/113517271415805462 2024-11-20 22:57:18+00:00| seen| https://t.me/cvedetector/11665...

CVE-2023-22806

CVE-2023-22806 affects LS ELECTRIC XBC-DN32U (OS version 01.80) where the device transmits sensitive information in cleartext over the XGT protocol, enabling potential credential disclosure. Root cause: cleartext transmission in XGT. Affected product/version: XBC-DN32U, OS 01.80. Impact: exposure...

CVE-2022-45437

Concretely, CVE-2022-45437 affects Artica PFMS Pandora FMS v765. The vulnerability is a stored Cross-Site Scripting (XSS) issue in the reporting dashboard module, caused by improper input neutralization. A user with edition privileges can create a Payload in the dashboard; an admin can observe it...

GitLab GitHub Repo Import Deserialization Remote Code Execution Exploit

An authenticated user can import a repository from GitHub into GitLab. If a user attempts to import a repo from an attacker-controlled server, the server will reply with a Redis serialization protocol object in the nested defaultbranch. GitLab will cache this object and then deserialize it when...

CVE-2023-22940

The CVE-2023-22940 issue affects Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. The root cause is that aliases of the collect SPL command (including summaryindex, sumindex, stash, mcollect, and meventcollect) were not designated as safeguarded commands, potentially allowing data to b...

U.S. Dept Of Defense: Reflected XSS in ██████

A reflected XSS vulnerability was found on one of the subdomains of a system. The vulnerability was located in the emailbody parameter of the PreviewLetterhead.aspx page. An attacker could exploit this vulnerability to execute malicious scripts and steal user's cookies, launch phishing attacks, a...