38664 matches found
VulnCheck KEV: CVE-2020-11899
The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability...
VulnCheck KEV: CVE-2018-0158
A vulnerability in the implementation of Internet Key Exchange Version 1 IKEv1 functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service DoS condition...
VulnCheck KEV: CVE-2018-0159
A vulnerability in the implementation of Internet Key Exchange Version 1 IKEv1 functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service DoS condition...
Microsoft Internet Explorer Remote Code Execution Vulnerability
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer...
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service...
Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting Vulnerability
Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting XSS Exploit Author: Momen Eldawakhly CyberGuy Vendor Homepage: https://www.zyxel.com Version: ZyWALL 2 Plus Tested on: Ubuntu Linux Firefox CVE : CVE-2021-46387 GET...
PT-2022-4879 · Qualcomm · Qualcomm Snapdragon Mobile +5
Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Auto affected versions not specified Qualcomm Snapdragon Compute affected versions not specified Qualcomm Snapdragon Connectivity affected versions not specified Qualcomm Snapdragon Industrial IOT affected versions not...
The Bug Report - February 2022 Edition
The Bug Report - February 2022 By Jesse Chick · March 2, 2022 Your Cybersecurity Comic Relief Image courtesy of https://toggl.com/ Why am I here? Welcome back to the Bug Report, stubby-month edition! For those in the audience unfamiliar with our shtick, every month we compile a shortlist of the t...
Zyxel ZyWALL 2 Plus Cross Site Scripting
Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting XSS Date: 1/3/2022 Exploit Author: Momen Eldawakhly CyberGuy Vendor Homepage: https://www.zyxel.com Version: ZyWALL 2 Plus Tested on: Ubuntu Linux Firefox CVE : CVE-2021-46387 GET...
CVE-2021-46387
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting XSS. Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard...
[SECURITY] Fedora 35 Update: seamonkey-2.53.11-1.fc35
SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...
CVE-2021-46387
CVE-2021-46387 affects ZyXEL ZyWALL 2 Plus Internet Security Appliance. The issue is a Cross-Site Scripting (XSS) vulnerability caused by insecure URI handling, enabling an attacker to execute arbitrary JavaScript in a user’s browser and potentially perform clipboard hijacking or session hijackin...
How Ukraine's Internet Can Fend Off Russian Attacks
The besieged country's complex internet infrastructure has evolved to promote resiliency...
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity because software that relies on UDP source port randomization are indirectly affected as well.
...
CISA adds recently disclosed Zimbra bug to its Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency CISA expanded its Known Exploited Vulnerabilities Catalog to include a recently disclosed zero-day flaw in the Zimbra email platform citing evidence of active exploitation in the wild. Tracked as CVE-2022-24682 CVSS score: 6.1, the issue...
ruby: StartTLS stripping vulnerability in Net::IMAP
Ruby's Net::IMAP module did not raise an exception when receiving an unexpected response to the STARTTLS command and the connection was not upgraded to use TLS. A man-in-the-middle attacker could use this flaw to prevent Ruby applications using Net::IMAP to enable TLS encryption for a connection ...
The vulnerability of the implementation of the Cisco Fabric Services over IP (CFSoIP) function in Cisco NX-OSS routing devices allows a attacker to trigger a service failure.
The vulnerability of the implementation of the Cisco Fabric Services over IP CFSoIP function in Cisco NX-OSS routing devices is related to an uncontrolled resource consumption during the processing of incoming CFSoIP packets. Exploiting this vulnerability could allow a malicious actor to cause...
Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs
In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types a...
The vulnerability of the Windows IKE extension in Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the Windows IKE extension in operating systems is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...