8095 matches found
WordPress Plugin Donations SQL Injection Vulnerability
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Donations plugin SQL injection vulnerability, the vulnerability stems from the inability to properly clean up and escape the...
WordPress plugin Master Elements SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Master Elements 8.0 and earlier versions are vulnerable to SQL injection, which stems from t...
pki-core:10.6 bug fix update
The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Bug Fixes: ipa: ERROR: 'Certificate operation cannot be completed: Unable to communicate with CMS 403 BZ2061458...
The vulnerability of the sapi_header_op function in the PHP programming language allows attackers to carry out XSS attacks.
The vulnerability of the sapiheaderop function in the PHP programming language is related to the lack of measures taken to protect web page structures. Exploiting this vulnerability allows an attacker to perform XSS attacks remotely...
Skeletons in the Closet: Security 101 Takes a Backseat to 0-days
Rarely a month goes by without the infosec industry being plagued by a new zero-day apocalypse. Most recently in December 2021, the world was swept by a series of vulnerabilities in Log4J – a popular logging system used by thousands of systems around the world. While writing this article, the...
CVE-2022-26674
ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service...
libinput 格式化字符串错误漏洞
libinput is a library that provides a complete input stack for display servers and other applications that need to handle kernel-provided input devices. A format string error vulnerability exists in libinput that stems from an error during a logging operation. An attacker can exploit this...
CLSA-2022-1650377052 Fix of CVE: CVE-2022-28390, CVE-2021-3609
can: emsusb: emsusbstartxmit: fix double devkfreeskb in error path ELSCVE-3847 CVE-2022-28390 - can: bcm: delay release of struct bcmop after synchronizercu ELSCVE-1694 CVE-2021-3609...
CLSA-2022-1650377026 Fix of CVE: CVE-2021-3609, CVE-2022-28390
can: emsusb: emsusbstartxmit: fix double devkfreeskb in error path ELSCVE-3847 CVE-2022-28390 - can: bcm: delay release of struct bcmop after synchronizercu ELSCVE-1694 CVE-2021-3609...
PT-2022-12157 · Fis +3 · Fis Gt.M +3
Name of the Vulnerable Software and Affected Versions: FIS GT.M versions through V7.0-000 Description: An issue allows attackers to cause a calculation of the size of calls to memset in op fnj3 in sr port/op fnj3.c to result in an extremely large value, leading to a segmentation fault and crashin...
CVE-2022-22187
An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service JIMS allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the...
Microsoft Disrupts ZLoader Cybercrime Botnet in Global Operation
Microsoft and a consortium of cybersecurity companies took legal and technical steps to disrupt the ZLoader botnet, seizing control of 65 domains that were used to control and communicate with the infected hosts. "ZLoader is made up of computing devices in businesses, hospitals, schools, and home...
CVE-2022-22187
An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service JIMS allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the...
USN-5378-1 gzip vulnerability
Cleemy Desu Wayo discovered that Gzip incorrectly handled certain filenames. If a user or automated system were tricked into performing zgrep operations with specially crafted filenames, a remote attacker could overwrite arbitrary files...
Directory traversal
AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user...
Pillow Input Validation Error Vulnerability (CNVD-2022-28799)
Pillow is a Python based image processing library. An input validation error vulnerability exists in versions of Pillow prior to 9.0.1, which stems from the product's remove operation not validating user input data, and can be exploited by an attacker to delete files...
ScheduleRunner - A C# Tool With More Flexibility To Customize Scheduled Task For Both Persistence And Lateral Movement In Red Team Operation
Scheduled task is one of the most popular attack technique in the past decade and now it is still commonly used by hackers/red teamers for persistence and lateral movement. A number of C tools were already developed to simulate the attack using scheduled task. I have been playing around with some...
Omron CX-Position Out-of-Bounds Writing Vulnerability
Omron CX-Position is a position control software from Omron Corporation of Japan. An out-of-bounds write vulnerability exists in Omron CX-Position, which stems from a failure to properly validate data when a program performs an operation in memory while processing a specific project file, and cou...
