17643 matches found
Multiple Trend Micro Products Input Validation Error Vulnerability
Trend Micro OfficeScan XG is a distributed anti-virus software, and Trend Micro Apex One is an endpoint security protection software that provides automated threat detection and response. Trend Micro Worry-Free Business Security is an enterprise-class information security protection solution...
Reboot of PunkSpider Tool at DEF CON Stirs Debate
Researchers will release a reboot of a controversial tool that crawls the web to identify back-end vulnerabilities in websites in the hopes that companies will quickly fix them and reduce security risks. However, experts have mixed feelings about the tool called PunkSpider, created by the analyti...
CVE-2021-20788
CVE-2021-20788 is a confirmed SSRF vulnerability in GroupSession products. A remote authenticated attacker can cause the server to perform a port scan from the affected appliance and/or reveal information from the internal Web server. Affected are GroupSession Free edition (versions before 5.1.0)...
CVE-2021-31291
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
#LetsTalkSecurity: The New Digital Normal
Let's Talk Security: Season 02 // Episode 03: Host, Rik Ferguson, interviews Founder & CEO of MyConnectedHealth, Tyler Cohen Wood. Together they discuss the new digital normal...
CVE-2021-37463
CVE-2021-37463 affects NCH Quorum v2.03 and earlier, with a stored XSS in the User Display Name. The root cause is a script injection that is stored and rendered in the user display context. Impact stated in CNVD/CNNVD references describes attackers potentially stealing cookie‑based authenticatio...
Cross-site Scripting (XSS) - Reflected in dolibarr/dolibarr
Description Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious...
CVE-2021-37436
CVE-2021-37436 affects Amazon Echo Dot devices. The connected sources describe a design/logic flaw that, after a factory reset, can let an attacker with physical access extract sensitive information through a sequence of hardware and software attacks. There are no published patch details in the p...
CNA legal filings lift the curtain on a Phoenix CryptoLocker ransomware attack
Two months after fully restoring its systems, CNA Financial, the leading US insurance company that was attacked by a group using Phoenix CryptoLocker ransomware, issued a legal notice of an information security incident to the Consumer Protection Bureau in New Hampshire. You may recall that Phoen...
CVE-2020-22283
Summary: CVE-2020-22283 is a buffer overflow in the lwIP implementation (Free Software Foundation) specifically in the function icmp6_send_response_with_addrs_and_netif() on the git head. This flaw could enable an attacker to retrieve sensitive information via a crafted ICMPv6 packet, with impact...
CVE-2021-32756
Summary: ManageIQ’s MiqExpression module is vulnerable to code injection. In versions prior to jansa-4 , kasparov-2 , and lasker-1 , a low-privilege user could craft a Ruby string that is evaluated, enabling execution of arbitrary code with root privileges on the host. The issue arises from evalu...
U.S. Dept Of Defense: System Error Reveals SQL Information
Hello, While testing your program i came across an endpoint that is leaking sql errors and queries from on of your websites. I use the following google dork to detect this: site:████████ "sql error" Endpoints leaking data: https://www.██████/██████████ https://www.███████/███ Some of the errors...
CVE-2020-5323
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 are affected by an injection vulnerability. A remote authenticated attacker with low privileges could potentially access sensitive information or cause a denial of servic...
Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple
CVE-2019-9053 💻 -h3x0v3rl0...
Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple
CVE-2019-9053 💻 -h3x0v3rl0...
IBM Security Access Manager Encryption Issue Vulnerability
IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. IBM Security Access Manager Docker suffers from a cryptographic issue vulnerabilit...
CVE-2021-0277
Summary (CVE-2021-0277): An out-of-bounds read in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved can cause DoS and may lead to remote code execution when processing crafted LLDP frames. Affected: Junos OS versions prior to listed fixed releases (e.g....
CVE-2021-20500
CVE-2021-20500 affects IBM Security Verify Access Docker 10.0.0, with an information-disclosure flaw that could reveal highly sensitive data to a local privileged user. The issue is confirmed in IBM’s vulnerability bulletin and related sources, which also lists a remediation: upgrade to the patch...