Juniper Junos OS Vulnerability (JSA11246)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11246 advisory. - In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers ar...

Weechat -- Possible man-in-the-middle attack in TLS connection to servers

The Weechat project reports: After changing the options weechat.network.gnutlscasystem or weechat.network.gnutlscauser, the TLS verification function is lost. Consequently, any connection to a server with TLS is made without verifying the certificate, which could lead to a man-in-the-middle attac...

CVE-2021-41849

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information PII in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity IMEI. This PII is transmitted to...

PT-2022-11500 · Luna Simo · Luna Simo

Name of the Vulnerable Software and Affected Versions: Luna Simo PPR1.180610.011/202001031830 Description: An issue was discovered in Luna Simo where it sends Personally Identifiable Information PII in plaintext using HTTP to servers located in China. The PII includes the user's list of installed...

Emotet Botnet's Latest Resurgence Spreads to Over 100,000 Computers

The insidious Emotet botnet, which staged a return in November 2021 after a 10-month-long hiatus, is once again exhibiting signs of steady growth, amassing a swarm of over 100,000 infected hosts for perpetrating its malicious activities. "While Emotet has not yet attained the same scale it once...

WordPress CorreosExpress plugin information leakage vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress CorreosExpress plugin 2.6.0 and previous...

WordPress Multisite Content Copier/Updater plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress application plugin. A cross-site scripting vulnerability exists in versions of the WordPres...

Understanding How Hackers Recon

Cyber-attacks keep increasing and evolving but, regardless of the degree of complexity used by hackers to gain access, get a foothold, cloak their malware, execute their payload or exfiltrate data, their attack will begin with reconnaissance. They will do their utmost to uncover exposed assets an...

Citrix PVS 1912: VDA servers boot fails randomly by error "PXE -32: TFTP open timeout no operating system found" during Restart schedule

VDA servers boot fails randomly by error "PXE -32: TFTP open timeout no operating system found" during Restart schedule...

Hackers Find a New Way to Deliver Devastating DDoS Attacks

Cybercriminals are exploiting a fleet of more than 100,000 misconfigured servers to knock websites offline...

Hackers Begin Weaponizing TCP Middlebox Reflection for Amplified DDoS Attacks

Distributed denial-of-service DDoS attacks leveraging a new amplification technique called TCP Middlebox Reflection have been detected for the first time in the wild, six months after the novel attack mechanism was presented in theory. "The attack … abuses vulnerable firewalls and content filteri...

Zero-day vulnerability in Zimbra Servers being exploited-in-the-wild

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here A zero-day cross-site scripting XSS vulnerability has been discovered in the Zimbra email software. A threat actor is taking advantage of this issue by launching a targeted spear-phishing attack named Operation EmailThief. Two...

Cross-site Scripting in Cipi

Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field...

GHSA-VPMW-77VM-4MJG Cross-site Scripting in Cipi

Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field...

WordPress Cost Calculator plugin path traversal vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A path traversal vulnerability exists in WordPress Cost Calculator plugin version 1.4 and earlier, which arise...

CVE-2022-24446

An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers and user information even if no SSH server or user is associated to the operator...

CVE-2022-24446

An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers and user information even if no SSH server or user is associated to the operator...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers and user information even if no SSH server or user is associated to the operator...

CVE-2022-24446

The CVE-2022-24446 entry concerns Zoho ManageEngine Key Manager Plus 6.1.6, where a user with Operator privileges can view all SSH servers and related user information regardless of associations. The connected documents confirm the affected software and the underlying issue as an access-control w...