10527 matches found
CVE-2021-43986
CVE-2021-43986 affects FANUC ROBOGUIDE (simulation platform). The issue stems from the setup program configuring files/folders with full access, allowing an attacker with SYSTEM-level access to overwrite binaries and escalate privileges. This is part of a broader set of ROBOGUIDE vulnerabilities ...
eu.lundegaard.liferay:liferay-db-setup-core (3.0.0) potentially affected by CVE-2022-26595 via com.liferay.portal:com.liferay.portal.impl (4.2.5)
com.liferay.portal:com.liferay.portal.impl MAVEN version 4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core 3.0.0 Source cves: CVE-2022-265...
eu.lundegaard.liferay:liferay-db-setup-core (>=3.1.0, <=3.2.0) potentially affected by CVE-2022-26595 via com.liferay.portal:com.liferay.portal.impl (5.13.3)
com.liferay.portal:com.liferay.portal.impl MAVEN version 5.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core =3.1.0, =3.2.0 Source cves:...
PT-2022-11966 · Fanuc · Roboguide
Name of the Vulnerable Software and Affected Versions: Affected product affected versions not specified Description: The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve...
Veritas NetBackup cross-site scripting vulnerability
Veritas NetBackup is a storage service used by Veritas, Inc. to provide backup and recovery capabilities for enterprise environments. Veritas NetBackup OpsCenter Analytics version 9.1 is vulnerable to a cross-site scripting vulnerability caused by a failure to effectively escape and filter the...
CWA 2202 : Published desktop fails to launch when CWA is used
-- Issue with CWA only -- Same endpoint works when same VDA is launched from Store URL -- Issue with 1 end point only -- Never worked on the CWA -- First time set up Details...
PT-2022-13577 · Siteground · Siteground Security Plugin
Name of the Vulnerable Software and Affected Versions: SiteGround Security plugin for WordPress versions up to, and including, 1.2.5 Description: The issue allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up. This enables...
ZOHO ManageEngine ADSelfService Plus has security vulnerabilities
An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...
linWinPwn - A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks
linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script leverages and is dependent of a number of tools including: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump. Setup Git clone the reposito...
PT-2022-7390
Name of the Vulnerable Software and Affected Versions Bitrix versions prior to 7.5.0 Description The issue is related to the unrestricted upload of dangerous file types in the "1C-Bitrix: Virtual Machine" VMBitrix virtual server. This can be exploited by a remote attacker to execute arbitrary cod...
EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers
EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add SSH keys to...
CVE-2021-27768
Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...
CVE-2022-27293
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Service DoS via the webpage parameter...
Use-After-Free
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash...
envoy: Use-after-free when tunneling TCP over HTTP
A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service...
envoy: Use-after-free when tunneling TCP over HTTP
A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service...
Exploit for Expression Language Injection in Vmware Spring_Cloud_Gateway
SpringCloud-Gateway Command Execution Vulnerability CVE-2022...
Exploit for Code Injection in Vmware Spring_Cloud_Gateway
SpringCloud-Gateway Command Execution Vulnerability CVE-2022...
Google Android security vulnerabilities
Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from a lack of privilege checks in Traceur that could bypass developer setup requirements to capture system traces. An attacker could exploi...
Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover
The plugin injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flocustomtableprefix cookie to an arbitrary value. On any website where flo-launch is active create cookie "flocustomtableprefix" with any string value to...