17619 matches found
CVE-2022-3143
CVE-2022-3143 affects WildFly Elytron where java.util.Arrays.equals is used in multiple places, enabling timing attacks. The root cause is unsafe comparisons potentially leaking information about secret values; the recommended fix is to replace such comparisons with java.security.MessageDigest.is...
CVE-2023-22487
Concrete details show that Flarum, via the flarum/mentions extension, leaks the full JSON:API payload of all mentioned posts in certain API responses (POST /api/posts, PATCH /api/posts/) regardless of access rights. Affected are all Flarum versions prior to 1.6.3; mitigation is to upgrade to flar...
Unlock Your Potential: Get 9 Online Cyber Security Courses for Just $49.99
Are you looking to take your career in the information security industry to the next level? Look no further than the 2023 Certified Technology Professional Bundle! This unparalleled offer grants you lifetime access to nine comprehensive courses in information security, hacking, and cybersecurity ...
Unlock Your Potential: Get 9 Online Cyber Security Courses for Just $49.99
Are you looking to take your career in the information security industry to the next level? Look no further than the 2023 Certified Technology Professional Bundle! This unparalleled offer grants you lifetime access to nine comprehensive courses in information security, hacking, and cybersecurity ...
CVE-2023-21527
creationtimestamp| type| source ---|---|--- 2023-01-11 00:28:57+00:00| seen| https://t.me/cibsecurity/56263...
Kibana 5.0.0 < 5.6.1 Cross-Site Scripting
According to its self-reported version number, the Kibana application running on the remote host is 5.0.0 prior to 5.6.1. It is, therefore, affected by the following vulnerabilities: - A cross-site scripting XSS in Timelion that could allow an attacker to obtain sensitive information from or...
CVE-2022-47866
Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php. Root cause: lack of input validation in constructing SQL statements. Impact per sources: high-severity (CRITICAL) with potential impact on confidentiality, integrity, and availability. No official ...
merseamuseum.org.uk Cross Site Scripting vulnerability OBB-3138273
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-0014
CVE-2023-0014 affects SAP NetWeaver ABAP Server and ABAP Platform on multiple SAP_BASIS versions (700…757) and kernel/CR components (e.g., 7.22, 7.53, 7.77, 7.81, 7.85, 7.89; KRNL64UC/NUC) where the system identity is created in an ambiguous format. This behavior can enable a capture-replay vulne...
CVE-2022-3855
creationtimestamp| type| source ---|---|--- 2023-01-10 02:28:06+00:00| seen| https://t.me/cibsecurity/56195 2025-04-09 18:48:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11129...
How much security is enough?
According to a prominent Soviet science fiction writer, beauty is a fine line, a razors edge between two opposites locked in a never-ending battle. Today, we would put it less poetically as an ideal compromise between contradictions. An elegant, or beautiful, design is one that allows reaching th...
varaservices.de Cross Site Scripting vulnerability OBB-3131824
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-3929
CVE-2022-3929 affects Hitachi Energy products FOXMAN-UN and UNEM (R9C–R15B). The issue arises from client–server communication partially using CORBA over TCP/IP, which is not encrypted and can allow tracing of internal messages. Public advisories indicate remediation is to upgrade to newer releas...
CVE-2022-3928
CVE-2022-3928 describes a hardcoded credential in the message queue of Hitachi Energy FOXMAN-UN and UNEM products (R9C–R15B). The vulnerability allows an attacker who can exploit it to access data in the internal message queue. Connected advisories and records confirm the affected families (FOXMA...
CVE-2023-22453
CVE-2023-22453 concerns Discourse where, before version 2.8.14 (stable) and 3.0.0.beta16 (beta/tests-passed), the number of times a user posted in an arbitrary topic was exposed to unauthorized users via the /u/username.json endpoint. The root cause is an information disclosure in the user-post c...
Bluebottle Cybercrime Group Preys on Financial Sector in French-Speaking African Nations
A cybercrime group dubbed Bluebottle has been linked to a set of targeted attacks against the financial sector in Francophone countries located in Africa from at least July 2022 to September 2022. "The group makes extensive use of living-off-the-land, dual use tools, and commodity malware, with n...
CVE-2019-25095
CVE-2019-25095 affects kakwa LdapCherry prior to 1.0.0. The vulnerability is a Cross-Site Scripting flaw stemming from an unknown function in the component URL Handler, enabling remote attack. Upgrading to version 1.0.0 addresses the issue (patch SHA 6f98076281e9452fdb1adcd1bcbb70a6f968ade9). Ven...
CVE-2022-43519
CVE-2022-43519 affects Aruba EdgeConnect Enterprise Orchestrator web-based management interface. The issue comprises multiple SQL injection vulnerabilities exploitable by an authenticated remote attacker, potentially allowing access to and modification of the underlying database and possibly comp...
CVE-2023-0039
CVE-2023-0039 is a duplicate of CVE-2022-4060. Connected sources detail a WordPress User Post Gallery plugin vulnerability (= 2.20 or apply vendor-provided fixes; disable the plugin if patching is not available. Other references consistently describe unauthenticated RCE via improper callback hand...