Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability

A majority of internet-exposed Cacti servers have not been patched against a recently patched critical security vulnerability that has come under active exploitation in the wild. That's according to attack surface management platform Censys, which found only 26 out of a total of 6,427 servers to ...

Microsoft Exchange Server Elevation of Privilege Vulnerability (CNVD-2023-51375)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An elevation of privilege vulnerability exists in Microsoft Exchange Server, which can be exploit...

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An information disclosure vulnerability exists in Microsoft Exchange Server, which can be exploit...

The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos OS-based routers of the QFX10K series allows a hacker to induce a service failure.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS-based QFX10K routers is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to trigger service failures remotely...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2023-59031)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An information disclosure vulnerability exists in Mozilla Firefox that originates from a sensitive feature in the display error message in a cross-origin response when the product imports resources usi...

CVE-2020-15679

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP...

Godfather Android banking malware is on the rise

Researchers at Cyble Research & Intelligence Labs CRIL have found a new version of the Android banking Trojan called Godfather. The new version of Godfather uses an icon and name similar to a legitimate application named MYT Music, which is hosted on the Google Play Store with over 10 million...

CVE-2022-3187

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established with the database. However, these PHP pages do not verify the validity of a user. Attackers could leverage this lack of verification to read...

IBM Cognos Analytics Server-Side Request Forgery Vulnerability

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. A server-side request forgery...

Adobe Experience Manager Access Control Error Vulnerability (CNVD-2023-54547)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the United States of America Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management...

AeroCMS 路径遍历漏洞

AeroCMS is a content management system from AeroCMS Inc. in the United States. AeroCMS version v0.0.1 suffers from a security vulnerability that stems from vulnerability to directory traversal attacks, which can be exploited by attackers to obtain sensitive information...

The vulnerability of the SuiteLink server, related to insufficient handling of exceptional states, allows a perpetrator to trigger a service failure.

The vulnerability of the SuiteLink server is related to insufficient handling of exceptional states. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

Mozilla: Use-after-free in Garbage Collection

The Mozilla Foundation Security Advisory describes this flaw as: The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash...

AeroCMS 跨站请求伪造漏洞

AeroCMS is a content management system from AeroCMS Inc. in the United States. A security vulnerability exists in AeroCMS version v0.0.1, which stems from vulnerability to cross-site request forgery CSRF attacks...

AeroCMS 安全漏洞

AeroCMS is a content management system from AeroCMS Inc. in the United States. AeroCMS version v0.0.1 suffers from a security vulnerability that stems from vulnerability to clickjacking attacks...

SUSE SLES15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:4284-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4284-1 advisory. Security fixes: - CVE-2022-32888: Fixed possible arbitrary code execution via maliciously crafted web content bsc1205121. -...

SUSE SLED15: libjavascriptcoregtk-4_0-18 / libjavascriptcoregtk-4_0-18-32bit / etc (SUSE-SU-2022:4285-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4285-1 advisory. Security fixes: - CVE-2022-32888: Fixed possible arbitrary code execution via maliciously crafte...

PT-2024-11844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array index out of bounds error exists in the DCN32 DML component of the AMD Direct Rendering Infrastructure DRI driver within the drivers/gpu/drm/amd/display/dc/dml/display mode vba....

Mozilla: Use-after-free in Garbage Collection

The Mozilla Foundation Security Advisory describes this flaw as: The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash...

The vulnerability of the server software HAProxy, related to deficiencies in handling exceptional states, allows a perpetrator to compromise data integrity.

The vulnerability of the server software HAProxy is related to deficiencies in handling exceptional states. Exploiting this vulnerability allows a remote attacker to compromise data integrity...