CVE-2022-1518 3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure...

CVE-2022-23079 motoradmin - host header Injection in the reset password functionality

In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim...

CVE-2022-31035

A Cross-site scripting XSS flaw was found in ArgoCD. This flaw allows a malicious actor to trigger a Cross-site scripting XSS vulnerability by storing a link point to a javascript code in ArgoCD UI. A successful attack depends on a user clicking the malicious link and triggering the function...

VMware HCX Information Disclosure Vulnerability

VMware HCX is an application mobility platform from VMware, Inc. Designed to simplify application migration, workload rebalancing and business continuity across data centers and clouds, VMware HCX versions 4.3.1 and 4.3.2 contain an information disclosure vulnerability stemming from the fact that...

CVE-2022-22953

VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the VMware HCX appliance may be able to gain access to sensitive information...

CISA Releases Security Advisory on Illumina Local Run Manager

CISA has released an Industrial Controls Systems Advisory ICSA detailing multiple vulnerabilities in Illumina Local Run Manager. Successful exploitation of these vulnerabilities may allow an unauthenticated malicious actor to take control of the affected product remotely and take any action at th...

GHSA-XF37-QCVF-7M57 Improper Authentication in SaltStack Salt

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software...

Improper Authentication in SaltStack Salt

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

Privilege escalation

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-21972 VMware vCenter Server Remote Code Execution Vul...

Denial of service in Apache Mesos

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster...

Examining the Black Basta Ransomware’s Infection Routine

We analyze the Black Basta ransomware and examine the malicious actor’s familiar infection tactics...

CVE-2022-22782

The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local...

The vulnerability of the Adobe Experience Manager content and media data management system, related to errors in authentication procedures, allows a perpetrator to trigger a service failure.

The vulnerability of the Adobe Experience Manager content and media data management system is related to errors in the authentication process. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the dtls1_clear_queues function in the OpenSSL library allows a attacker to cause a service failure or potentially cause other effects.

The vulnerability of the dtls1clearqueues function in the OpenSSL library arises due to buffer overflow. Exploiting this vulnerability could allow a malicious actor to cause service interruptions or potentially other adverse effects...

CVE-2022-27179

A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised...

Hardcoded credentials

Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicious actor. The size of certain communications packets are predictable. This would allow an attacker to learn the state of the system if the...

CVE-2022-27179 ICSA-22-104-03 Red Lion DA50N

A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised...

CVE-2022-27179

CVE-2022-27179 is associated with Red Lion DA50N gateways, where an attacker with access to an exported configuration file may obtain stored credentials and access protected resources. The connected ICS advisory (CISA ICSA-22-104-03) ties this vulnerability to insecure credential handling (cited ...