New Cryptojacking Operation Targeting Kubernetes Clusters for Dero Mining

Cybersecurity researchers have discovered the first-ever illicit cryptocurrency mining campaign used to mint Dero since the start of February 2023. "The novel Dero cryptojacking operation concentrates on locating Kubernetes clusters with anonymous access enabled on a Kubernetes API and listening ...

Authorization Bypass

snort is vulnerable to Authorization Bypass. The application detection engine has a vulnerability that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system by sending crafted packets. A successful exploit could allow the attacker to deliver a...

Authorization Bypass

snort is vulnerable to Authorization Bypass. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device, allowing them to bypass configured file policy for HTTP packets and deliver a malicious payload...

Authorization Bypass

snort is vulnerable to Authorization Bypass. An unauthenticated, remote attacker is able to exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device, allowing them to bypass configured file policy for HTTP packets and deliver a malicious payload...

Authorization Bypass

snort is vulnerable to authorization bypasses. An unauthenticated, remote attacker may exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit allows the attacker to bypass the configured file policies and deliver a malicious...

Authorization Bypass

snort is vulnerable to authorization bypasses. An unauthenticated, remote attacker is able to exploit this vulnerability by sending crafted HTTP packets through an affected device, allowing them to bypass a configured file policy for HTTP packets and deliver a malicious payload...

File Policy Bypass

snort is vulnerable to File Policy Bypass. The vulnerability exists due to incorrect handling of specific HTTP header parameters, which allows an attacker to bypass the configured file policy for HTTP packets and deliver a malicious payload by sending maliciously crafted HTTP packets...

Authorization Bypass

snort is vulnerable to Authorization Bypasses. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious...

Cross site scripting

A stored Cross-site Scripting XSS vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post...

Stored XSS in Notification and Data Management

Description Please enter a description of the vulnerability. Proof of Concept 1. Go to a survey and to Settings = Notifications and data. 2. Turn off Inherit option for Send basic notification email to: or Send basic notification email to: 3. Enter the following payload: " and Save...

K88162221: The BIG-IP ASM system may not properly perform signature checks on cookies

Security Advisory Description The BIG-IP ASM system may not properly perform signature checks on cookies. This issue occurs when the following condition is met: You have a security policy enabled with cookie scope attack signatures. Impact Cookies containing malicious payload may pass through the...

K32562850: jackson-databind vulnerabilities CVE-2019-16943 and CVE-2019-17531

Security Advisory Description CVE-2019-16943 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the p6spy 3.8.6 jar in t...

K16090: BIG-IP Automatic Update Check and ASM Automatic Signature Update man-in-the-middle vulnerability CVE-2014-9326

Security Advisory Description The automatic signature update functionality in the 1 Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the 2 Call Home feature in ASM 10.0.0...

Microweber Cross-site Scripting vulnerability

Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted i...

Cross site scripting

textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches...

Debian DSA-5354-1 : snort - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5354 advisory. Multiple security vulnerabilities were discovered in snort, a flexible Network Intrusion Detection System, which could allow an unauthenticated, remote attacker t...

Git 代码问题漏洞

Git is a free, open source distributed version control system. A security vulnerability exists in Git versions prior to 2.39.2. An attacker could exploit this vulnerability to place a malicious payload in the Git for Windows installer...

Debian dla-3317 : snort - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3317 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3317-1 [email protected]...

Design/Logic Flaw

Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicious payload execution...

CVE-2022-34459

CVE-2022-34459 concerns three Dell update products: Dell Command | Update, Dell Update, and Alienware Update, all versions prior to 4.7 . The flaw is an improper verification of cryptographic signatures in the function Get Applicable Driver Component, enabling a local attacker to potentially exec...