Samsung Galaxy Store Bug Could've Let Hackers Secretly Install Apps on Targeted Devices

A now-patched security flaw has been disclosed in the Galaxy Store app for Samsung devices that could potentially trigger remote command execution on affected phones. The vulnerability, which affects Galaxy Store version 4.5.32.4, relates to a cross-site scripting XSS bug that occurs when handlin...

CVE-2022-40742

Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service...

Simple Cold Storage Management System SQL Injection Vulnerability (CNVD-2023-69723)

Simple Cold Storage Management System is a simple cold storage management system. A SQL injection vulnerability exists in Simple Cold Storage Management System. An attacker could use this vulnerability to view, add, modify, or delete information in a back-end database...

WHAT YOU SHOULD KNOW: Patch OpenSSL 3.x

...

CVE-2022-3708

CVE-2022-3708 affects the WordPress Web Stories plugin prior to version 1.25.0, with SSRF arising from inadequate validation of the url parameter in the /v1/hotlink/proxy REST API. The vulnerability allows authenticated users to cause the web application to perform requests to arbitrary external/...

CVE-2022-3723

creationtimestamp| type| source ---|---|--- 2022-10-28 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=905 2022-10-28 07:20:25+00:00| published-proof-of-concept| https://t.me/cKure/10350 2022-10-28 12:42:48+00:00| exploited|...

CVE-2014-5329

creationtimestamp| type| source ---|---|--- 2022-10-27 07:57:35+00:00| seen| MISP/b2ae918a-f037-4dc1-8819-f2aa7e0f66f9 2023-09-08 07:19:21+00:00| seen| https://t.me/cibsecurity/70129...

CVE-2017-7455

creationtimestamp| type| source ---|---|--- 2022-10-27 07:41:30+00:00| seen| MISP/b2ae918a-f037-4dc1-8819-f2aa7e0f66f9...

CVE-2022-36783

CVE-2022-36783 affects AlgoSec FireFlow with a Reflected Cross-Site-Scripting (RXSS) vector. A malicious user can inject JavaScript into the IntersectudRule parameter on the search/result.html page by changing the request method from POST to GET and sharing the URL with a victim. This results in ...

CVE-2021-46849

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29421. Reason: This candidate is a duplicate of CVE-2021-29421. Notes: All CVE users should reference CVE-2021-29421 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

Threat Roundup for October 14 to October 21

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 14 and Oct. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

CVE-2022-41806

CVE-2022-41806 affects BIG-IP AFM NAT64 policy vulnerabilities where IPv6/IPv4 translation rules on a virtual server can cause memory resource utilization increases leading to DoS. Affected versions: BIG-IP 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1. Fixes are introduced in 16.1.3.2 (and 1...

CVE-2022-42467

Summary of affected component: Apache Isis h2 webconsole module in prototype mode. Vulnerability mechanism: The webconsole is automatically available in prototype mode, enabling direct database queries; safeguards require explicit enablement via configuration. Root cause/mitigation details: Since...

CVE-2022-43045

GPAC 2.1-DEV-rev368-gfd054169b-master is impacted by CVE-2022-43045 due to a segmentation fault in gf_dump_vrml_sffield (scene_dump.c). This affects availability (per CVSS v3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and is documented across multiple trackers (NVD, OSV, Nessus-style feeds, Gentoo G...

CVE-2022-22234

Summary (CVE-2022-22234) An Improper Preservation of Consistency Between Independent Representations of Shared State in the Packet Forwarding Engine (PFE) of Juniper Junos OS can cause a DoS when the device is very busy, e.g., during CLI show commands, potentially marking SFPs as unplugged and af...

CVE-2022-32176

Gin-Vue-Admin is affected in versions v2.5.1 through v2.5.3b by an Unrestricted File Upload through the Media Library’s Compress Upload feature, enabling JavaScript execution and exposure of admin cookies, which can lead to account takeover. Root cause: insufficient restriction of file uploads. I...

CVE-2022-3293

GitLab EE vulnerability CVE-2022-3293: Email addresses were leaked in WebHook logs affecting all versions from 9.3 up to 15.2.5, 15.3 up to 15.3.4, and 15.4 up to 15.4.1. The connected sources confirm the affected product (GitLab EE) and the impact (exposure of email addresses via WebHook logs). ...

CVE-2022-3330

CVE-2022-3330 is a GitLab CE/EE vulnerability where a guest user could read a todo targeting an inaccessible note. Affected are GitLab versions: 15.0 up to 15.2.5 (pre-15.2.5), 15.3 up to 15.3.4 (pre-15.3.4), and 15.4 up to 15.4.1 (pre-15.4.1). The connected sources confirm the existence of this ...

ndsu.edu Cross Site Scripting vulnerability OBB-2999350

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Nextcloud: Mail app - blind SSRF via imapHost parameter

A blind SSRF vulnerability was discovered in the Nextcloud Mail application. An attacker could exploit this vulnerability to retrieve services running locally on the server and scan the internal network for information about which IPs are responding and which services are running on each IP...