38946 matches found
May 24, 2022—KB5014021 (OS Build 20348.740) Preview
None None...
Microsoft Internet Explorer Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information...
Zyxel USG/ZyWALL 授权问题漏洞
Zyxel USG/ZyWALL is a firewall from China's Heqin Technology Zyxel. An authorization issue vulnerability exists in Zyxel USG/ZyWALL versions 4.32-4.71, USG FLEX 4.50-5.21, ATP 4.32-5.21, and VPN 4.32-5.21, which stems from the lack of proper access control mechanisms and can be exploited to allow...
Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service DoS via a crafted website...
Microsoft Internet Explorer Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer...
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer...
Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk...
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below. PoC...
Microsoft Internet Explorer Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk...
Zphisher-GUI-Back_office - A Zphisher GUI Back-Office Plugin
DISCLAIMER This toolkit contains materials that can be potentially damaging or dangerous for social media. Refer to the laws in your province/country before accessing, using,or in any other way utilizing this in a wrong way. This Tool is made for educational purposes only. Do not attempt to viola...
CVE-2022-22972
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. Rapid7 Analysis...
380K Kubernetes API Servers Exposed to Public Internet
More than 380,000 Kubernetes API servers allow some kind of access to the public internet, making the popular open-source container-orchestration engine for managing cloud deployments an easy target and broad attack surface for threat actors, researchers have found. The Shadowserver Foundation...
VulnCheck KEV: CVE-2022-27593
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign...
CVE-2022-24856
FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...
CVE-2022-24856 Server-Side Request Forgery in FlyteConsole
FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...
GHSA-6RM6-MJMH-86JQ HTML Purifier Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
HTML Purifier Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-W2XX-JP9F-GP8G Yii Framework Cross-site Scripting Vulnerability
Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...
Yii Framework Cross-site Scripting Vulnerability
Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...
The vulnerability of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD), a micro-programming network interface device, allows attackers to gain unauthorized access to protected information.
The vulnerability of Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD, which are microprogramming network devices, is related to encryption deficiencies using the Galois/Counter Mode GCM authentication method. Exploiting this vulnerability can allow an attacker to gai...