The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism, related to the lack of protection measures for the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a attacker to execute arbitrary code...

The vulnerability of the threat detection mechanism of Microsoft Defender for IoT, related to access control deficiencies, allows attackers to elevate their privileges within the system.

The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to gain increased privileges within the system...

CVE-2022-23397

The CVE-2022-23397 entry affects Cedar Gate EZ-NET Portal versions 6.5.5 through 6.8.0. A vulnerability exists in the portal’s handling of URL parameters during the display of messages to users, where data sent via the URL is not properly sanitized, enabling Reflected Cross-Site Scripting. The is...

The vulnerability of the threat detection mechanism for Microsoft Defender for IoT, related to improper code generation, allows a malicious actor to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted request...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...

CVE-2022-21716

CVE-2022-21716 affects Twisted (Python, event-driven networking framework). The issue arises in Twisted SSH client/server where, prior to 22.2.0, the peer SSH version identifier can be fed an unlimited amount of data, causing a memory-exhaustion vulnerability (buffer growth). The example of explo...

VulnCheck KEV: CVE-2017-12237

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service...

CVE-2022-21716 Buffer Overflow in Twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

Microsoft Internet Explorer Use-After-Free Vulnerability

A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code...

VulnCheck KEV: CVE-2018-0159

A vulnerability in the implementation of Internet Key Exchange Version 1 IKEv1 functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. The vulnerability is...

VulnCheck KEV: CVE-2018-0158

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service DoS condition. The vulnerability is due to...

VulnCheck KEV: CVE-2020-11899

The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability...

Microsoft Internet Explorer Remote Code Execution Vulnerability

This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer...

Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service...

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting Vulnerability

Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting XSS Exploit Author: Momen Eldawakhly CyberGuy Vendor Homepage: https://www.zyxel.com Version: ZyWALL 2 Plus Tested on: Ubuntu Linux Firefox CVE : CVE-2021-46387 GET...

PT-2022-4879 · Qualcomm · Qualcomm Snapdragon Mobile +5

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Auto affected versions not specified Qualcomm Snapdragon Compute affected versions not specified Qualcomm Snapdragon Connectivity affected versions not specified Qualcomm Snapdragon Industrial IOT affected versions not...

The Bug Report - February 2022 Edition

The Bug Report - February 2022 By Jesse Chick · March 2, 2022 Your Cybersecurity Comic Relief Image courtesy of https://toggl.com/ Why am I here? Welcome back to the Bug Report, stubby-month edition! For those in the audience unfamiliar with our shtick, every month we compile a shortlist of the t...

Zyxel ZyWALL 2 Plus Cross Site Scripting

Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting XSS Date: 1/3/2022 Exploit Author: Momen Eldawakhly CyberGuy Vendor Homepage: https://www.zyxel.com Version: ZyWALL 2 Plus Tested on: Ubuntu Linux Firefox CVE : CVE-2021-46387 GET...

CVE-2021-46387

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting XSS. Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard...

[SECURITY] Fedora 35 Update: seamonkey-2.53.11-1.fc35

SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...