WordPress plugin YOP Poll 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2022-27873

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

Internet Bug Bounty: CVE-2022-21831: Possible code injection vulnerability in Rails / Active Storage

Original report: https://hackerone.com/reports/1154034 Rails advisory: https://discuss.rubyonrails.org/t/cve-2022-21831-possible-code-injection-vulnerability-in-rails-active-storage/80199 Blogpost:...

CVE-2022-30276

The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication MDLC networks potentially over a variety of serial, RF and/or Ethernet links and TCP/IP networks...

Demo: Your data has been encrypted! Stopping ransomware attacks with Malwarebytes EDR

It’s no secret that ransomware is one of the most pressing cyber threats of our day. What worse, ransomware gangs have increased their attacks on a range of vulnerable industries, with disruptions to business operations, million-dollar ransom demands, data exfiltration, and extortion. With...

Apache Apereo CAS Log4Shell Direct Check (CVE-2021-44228)

Binary data apacheapereocaslog4shell.nbin...

Integrating JIRA to the Qualys Cloud Platform

This is the second in a blog series on integrations to the Qualys Cloud Platform. This post looks at what are the requirements to build a successful integration and workarounds when some of the pieces are missing functionality. We then specifically consider the question of integrated Qualys with...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

Sql injection

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

CVE-2022-29709

CVE-2022-29709 affects CommuniLink Internet Limited CLink Office v2.0. Multiple SQL injection vulnerabilities exist via the username and password parameters, enabling unauthenticated attackers to potentially disclose data (Confidentiality impact High; others not affected per the entry). The NVD e...

Russia Is Quietly Ramping Up Its Internet Censorship Machine

Since Vladimir Putin blocked Facebook, Instagram, and Twitter in March, Russia has been pushing away from the global internet at a rapid pace...

The Unsolved Mystery Attack on Internet Cables in Paris

As new details about the scope of the sabotage emerge, the perpetrators—and the reason for their vandalism—remain unknown...

The vulnerability of the Microsoft Internet Information Services (IIS) Server network services on the Windows operating system allows a perpetrator to cause a service failure.

The vulnerability of the Microsoft Internet Information Services IIS Server network services on the Windows operating system is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status analysis tool, the BIG-IP Application Acceleration Manager, the DDoS protection module, the BIG-IP Fraud Protection Service, the Internet traffic balancing system, the BIG-IP Link Controller, and the local traffic balancing system – all of these allow a perpetrator to cause service interruptions.

The vulnerabilities of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status...

The vulnerability of the Internet Information Server (IIS) on Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Internet Information Server IIS on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the Cachuri module in the Microsoft Internet Information Services (IIS) network services for Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the Cachuri module in the Microsoft Internet Information Services IIS network services for Windows operating systems is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

PT-2022-21532 · Apple · Macos Monterey +2

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 15.6 macOS Monterey versions prior to 12.5 Description: A logic issue was addressed with improved state management, which could allow a user to be tracked through their IP address. Recommendations: For Safari versions...

CVE-2022-24082

If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running o...

Cross-site Scripting (XSS)

angular is vulnerable to cross-site scriptingXSS attacks. The library permits interpolation of elements due to insecure page caching, allowing an attacker to inject and execute malicious javascript on the victim's browser. This vulnerability only affects Internet Explorer...