17635 matches found
CVE-2022-26331
CVE-2022-26331 affects Micro Focus ArcSight Logger. Vulnerable are ArcSight Logger versions prior to 7.2.2. The issue could be remotely exploited to cause Information Disclosure or Self Cross-Site Scripting (XSS). Root cause details are not specified in the provided documents. Remediation: upgrad...
CVE-2022-2519
There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1...
CVE-2022-36657
CVE-2022-36657 affects Library Management System v1.0. The vulnerability is a cross-site scripting (XSS) flaw in the component /librarian/edit_book_details.php. Root cause details are not fully specified in the provided documents. Potential impact is XSS in the user context; no exploitation detai...
CVE-2022-0851
CVE-2022-0851 concerns convert2rhel exposing the activation key in process command lines when passing it to subscription-manager. Public docs tie this to the Convert2RHEL utility and indicate an exposure that could enable fraud via registering systems using the victim’s activation key. Red Hat ad...
CVE-2022-36707
CVE-2022-36707 is a reservation duplicate of CVE-2022-2214 (the CVE entry is not to be used). Connected records provide concrete details for CVE-2022-2214: a critical SQL injection in SourceCodester Library Management System 1.0. The vulnerability affects the /librarian/bookdetails.php endpoint a...
CVE-2022-36537
creationtimestamp| type| source ---|---|--- 2022-08-27 00:30:26+00:00| seen| https://t.me/cibsecurity/48923 2022-11-01 12:31:11+00:00| seen| https://t.me/thehackernews/2720 2022-12-09 12:28:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3580 2022-12-09 14:25:09+00:00|...
CVE-2020-27796
CVE-2020-27796 affects UPX 4.0.0, with a heap-based buffer over-read in the function invert_pt_dynamic within p_lx_elf.cpp , exploitable via a crafted Mach-O file. All connected sources consistently describe this as a vulnerability in UPX 4.0.0, without providing vendor patches or explicit mitiga...
CVE-2022-23715
CVE-2022-23715 affects Elastic Cloud Enterprise (ECE) prior to 3.4.0. A flaw in the Logging and Monitoring cluster may cause disclosure of sensitive information (e.g., user passwords and Elasticsearch keystore values) in logs. The vulnerable endpoints are PATCH /api/v1/user and PATCH /deployments...
CVE-2021-0947
CVE-2021-0947 involves a kernel information disclosure in Android's graphics stack. The method PVRSRVBridgeTLDiscoverStreams allocates a heap buffer for streams, fills it via TLServerDiscoverStreamsKM, then copies it to userspace. If TLServerDiscoverStreamsKM fails (e.g., due to invalid sizes), t...
m.4o4gsw.cyou Cross Site Scripting vulnerability OBB-2861687
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-3763
Affected software: Red Hat AMQ Broker management console (7.8). Vulnerability: information disclosure due to incorrect checks of role bindings; an existing user may access limited data that should be restricted. Impact: primarily confidentiality; no direct integrity impact reported. Root cause: r...
CVE-2021-3701
CVE-2021-3701 affects Ansible Runner, where the default temporary files configuration can cause temp files to be created in world-writable locations. An attacker who can authenticate locally could pre-create or redirect such directories, enabling reading private information or causing Ansible Run...
CVE-2022-27637
CVE-2022-27637 is a reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1–1.5.3. The flaw allows a remote attacker to inject arbitrary JavaScript via unspecified vectors, with the impact described as user script execution in the affected web application. The public details consi...
CVE-2022-35154
creationtimestamp| type| source ---|---|--- 2022-08-18 12:41:14+00:00| seen| https://t.me/cibsecurity/48330...
CVE-2022-29550
CVE-2022-29550 affects Qualys Cloud Agent 4.8.0-49 and concerns logging of ps auxwwe output to /var/log/qualys/qualys-cloud-agent-scan.log. The issue could expose credentials from environment variables in the log if verbose tracing is enabled; the vendor notes the ps data collection is intentiona...
Researchers Link Multi-Year Mass Credential Theft Campaign to Chinese Hackers
A Chinese state-sponsored threat activity group named RedAlpha has been attributed to a multi-year mass credential theft campaign aimed at global humanitarian, think tank, and government organizations. "In this activity, RedAlpha very likely sought to gain access to email accounts and other onlin...
CVE-2022-2856
creationtimestamp| type| source ---|---|--- 2022-08-17 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=854 2022-08-17 21:28:06+00:00| exploited| https://t.me/cibsecurity/48294 2022-08-18 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=856 2022-08-18...