Zero-Day Remote Code Execution Vulnerability in Zimbra Collaboration Suite

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The active exploitation of an unpatched CVE-2022-41352 remote code execution RCE vulnerability found in the Zimbra Collaboration Suite ZCS. It empowers attackers to upload arbitrary files and...

Samsung score drive competition condition loophole

Samsung score drive is a driver for Samsung mobile devices. samsung score drive is vulnerable to a contention condition. The vulnerability stems from the lack of proper synchronization points and can be exploited by attackers to perform malicious operations...

CVE-2022-33691

A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations...

Race condition

A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations...

GHSA-MJ73-5X75-9PHH Singularity insecure permissions

Insecure permissions 777 are set on $HOME/.singularity when it is newly created by Singularity version from 3.3.0 to 3.5.1, which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services...

Cardiologist moonlighted as successful ransomware developer

The US has charged a 55-year-old French-Venezuelan cardiologist from Venezuela with "attempted computer intrusions and conspiracy to commit computer intrusions". This was revealed in an unsealed complaint in a federal court in Brooklyn, New York. Moises Luis Zagala Gonzales worked as a ransomware...

Double free

There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affectin...

Samsung SMR DSP Driver Resource Management Error Vulnerability

Samsung SMR is a system patch package from South Korea's Samsung Samsung. The Samsung SMR DSP driver is vulnerable to resource management errors, which can be exploited by attackers to perform malicious operations...

Totolink A3100R Security Feature Issue Vulnerability

The TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.The TotoLink A3100R V5.9c.4577 is vulnerable to a security feature issue that could be exploited by attackers to hijack a valid session and perform further malicious operations...

CVE-2021-46010

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSIONID is predictable. An attacker can hijack a valid session and conduct further malicious operations...

Design/Logic Flaw

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSIONID is predictable. An attacker can hijack a valid session and conduct further malicious operations...

Remote Code Execution (RCE)

github.com/sourcegraph/sourcegraph, is vulnerable to remote code execution. The vulnerability exists because of the failure in call restriction in git config, allowing an attacker to make HTTP requests to internal services and perform the malicious operations remotely...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution. The vulnerability exists because of the reliance on protection mechanism of HTTP permission methods, allowing an attacker to bypass intended access restrictions and to perform the malicious operations remotely...

Flatpak path traversal vulnerability

Flatpak is an application virtualization system for Linux desktop application computing environments. flatpak is vulnerable and can be exploited by malicious applications to replace appstream util binaries and potentially perform other malicious operations...

Samsung SMR 资源管理错误漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in Samsung SMR AUG-2021 versions prior to version 1, which originates in the conngadget driver allowing an attacker to perform malicious operations...

Shell command injection in Apache Syncope

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

GHSA-P2RP-CMJQ-R7WM Shell command injection in Apache Syncope

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2021-22321

There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious operations. This can cause memory use-after-free, compromising normal service. Affected product include...

Design/Logic Flaw

There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious operations. This can cause memory use-after-free, compromising normal service. Affected product include...

ELECOM NCC-EWF100RMWH2 Cross-Site Request Forgery Vulnerability

The ELECOM NCC-EWF100RMWH2 is a wireless access device. The ELECOM NCC-EWF100RMWH2 suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to construct a malicious URI, bait a request, and perform a malicious operation in the context of the target user...