17638 matches found
AM Live Vulnerability Management Conference 2022: my impressions and position
Hello everyone! This episode will be about the AM Live Vulnerability Management online conference. I participated in it on May 17th. Alternative video link for Russia: The event lasted 2 hours. Repeating everything that has been said is difficult and makes little sense. Those who want can watch t...
CVE-2022-29084
creationtimestamp| type| source ---|---|--- 2022-06-03 00:26:02+00:00| seen| https://t.me/cibsecurity/43785...
CVE-2022-32250
creationtimestamp| type| source ---|---|--- 2022-06-03 00:25:55+00:00| seen| https://t.me/cibsecurity/43781 2022-07-06 16:33:44+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2655 2022-08-25 07:18:28+00:00| published-proof-of-concept| https://t.me/proxybar/945 2022-08-25...
CVE-2022-26866
Dell PowerStore is affected by a Stored Cross-Site Scripting vulnerability in versions before v2.1.1.0. A high-privilege network attacker could store malicious HTML/JavaScript in the trusted application data store; when victims access data via their browsers, the code can execute in the web app c...
CVE-2022-32015
Complete Online Job Search System 1.0 is vulnerable to SQL injection via /eris/index.php?q=category&search=. The issue, repeatedly reported across CVE-2022-32015 records (NVD, NUCLEI template, CNVD, RH and others), indicates that unsanitized input to the category search parameter allows an attack...
Threat Source newsletter (June 2, 2022) — An RSA Conference primer
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Many of you readers may be gearing up for a West Coast swing over the next few weeks through San Francisco and Las Vegas for RSA and Cisco Live, respectively. And we’re right behind you! Talos... This is only the...
CVE-2021-43307
CVE-2021-43307 is a Denial of Service vulnerability in the semver-regex npm package that can be triggered by arbitrary input to the test() method, causing an exponential ReDoS. Public sources (CNVD-2022-76985) indicate DoS affects semver-regex versions prior to 3.1.4 and 4.0.0–4.0.2; patch versio...
CVE-2022-31957
Rescue Dispatch Management System v1.0 is affected by a SQL injection vulnerability in the web interface, specifically via rdms/admin/teams/view_team.php?id= without input validation. The issue, as reported across multiple sources, originates from unsafely constructed SQL statements that incorpor...
PUB-A-127973231
Bulletin has no description...
CVE-2022-1893
CVE-2022-1893 affects polonel/trudesk before 1.2.3. The root cause is improper removal of sensitive information before storage or transfer, leading to information disclosure to unauthorized participants. Impact reported as exposure of sensitive data; multiple sources (NVD, Red Hat, CNVD) describe...
Phabricator: Deprecated owners.query API bypasses object view policy
The deprecated owners.query API does not check object view policy. A user is able to view some information about an owner package which they do not have permission to see by calling this API. Since the API is deprecated, it could just be removed. Impact An attacker is able to view some informatio...
CVE-2022-24581
CVE-2022-24581 affects ACEweb Online Portal 3.5.065. The issue allows unauthenticated users to trigger SMB hash disclosure by providing the UNC path of an external SMB share during file upload, causing the victim server to reveal the username and password hash of the ACEweb Online software user. ...
CVE-2022-20670
creationtimestamp| type| source ---|---|--- 2022-05-27 18:15:16+00:00| seen| https://t.me/cibsecurity/43492...
SQL injection in jflyfox jfinal
Jfinal cms 5.1.0 is vulnerable to SQL Injection...
CVE-2022-30585
CVE-2022-30585 affects Archer Platform 6.x before 6.11 (6.11.0.0) where the REST API permits an Authorization Bypass. A remote authenticated malicious user could view sensitive information. Affected/fixed releases noted: 6.11.0.0 fixes the issue; older releases such as 6.10.0.3 and 6.9.3.4 are al...
CVE-2022-1868
No description is available for this CVE...
CVE-2022-1876
No description is available for this CVE...