CVE-2022-0949: Improper Neutralization of Special Elements used in an SQL Command

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbotsgravafingerprint AJAX action, available to unauthenticated users,...

PT-2022-13549

Name of the Vulnerable Software and Affected Versions The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin versions prior to 6.930 Description The issue arises from the improper sanitization and escaping of the fingerprint parameter before its use in...

Saltstack SaltStack Salt 授权问题漏洞

Saltstack SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions 3002.8, 3003.4, and 3004.1, which originates fr...

Metasploit Weekly Wrap-Up

Capture Plugin Capturing credentials is a critical and early phase in the playbook of many offensive security testers. Metasploit has facilitated this for years with protocol-specific modules all under the auxiliary/server/capture. Users can start and configure each of these modules individually,...

North Korean state-sponsored threat actor Lazarus Group exploiting Chrome Zero-day vulnerability

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here For more than a month before a fix was available, North Korean state hackers known as Lazarus group exploited a zero-day, remote code execution vulnerability CVE-2022-0609 in Google Chromes web browser. The attack mainly targe...

CVE-2022-26534

FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change view excessively and stop generating blocks...

WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi

The plugin does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbotsgravafingerprint AJAX action, available to unauthenticated users, leading to a SQL injection PoC curl -i 'https://example.com/wp-admin/admin-ajax.php' --data...

WordPress Stop Bad Bots plugin <= 6.92 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Stop Bad Bots plugin versions = 6.92. Solution Update the WordPress Stop Bad Bots plugin to the latest available version at least 6.930...

FISCO-BCOS 安全漏洞

FISCO-BCOS is an externally open source, secure and controlled enterprise-grade financial blockchain underlying technology platform. A security vulnerability exists in FISCO-BCOS, which originates from the use of a malicious node to cause a normal node to overly change its view and stop generatin...

The vulnerability of the microprogrammed software of the SIMATIC S7-1200 programmable logic controller lies in the possibility for unauthorized users to execute commands, allowing intruders to initiate and terminate the controller’s operations.

The vulnerability of the microprogrammed control system of the SIMATIC S7-1200 programmable logic controller is related to the possibility for unauthorized users to execute commands. Exploiting this vulnerability could allow an intruder, operating remotely, to execute commands to start and stop t...

Siemens S7-1200 - Unauthenticated Start / Stop Command Vulnerability

Exploit Title: Unauthenticated Siemens S7-1200 CPU Start/Stop Command Exploit Author: RoseSecurity Vendor Homepage: https://www.siemens.com/global/en.html Version: V4.5 and below Tested on: Siemens S7-1200 CPU: 1215C IP == PLC IP address Start Command curl -i -s -k -X $'POST' \ -H $'Host: ' -H...

Siemens S7-1200 - Unauthenticated Start/Stop Command

Exploit Title: Unauthenticated Siemens S7-1200 CPU Start/Stop Command Date: 09/03/2022 Exploit Author: RoseSecurity Vendor Homepage: https://www.siemens.com/global/en.html Version: V4.5 and below Tested on: Siemens S7-1200 CPU: 1215C IP == PLC IP address Start Command curl -i -s -k -X $'POST' \ -...

PT-2022-28868

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.5 through v5.15.21 Description A potential issue exists in the Linux Kernel that could lead to a crash when using stop filters in single-range mode. The actual impact and attack plausibility have not yet been proven...

PT-2022-28955

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.5 through 5.16.7 Description The issue is related to a crash with stop filters in single-range mode in the perf/x86/intel/pt module. The actual impact and attack plausibility have not yet been proven. Recommendations Fo...

PT-2022-28512

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.5 through v5.10.98 Description A potential issue exists in the Linux Kernel that could lead to a crash when using stop filters in single-range mode. The actual impact and attack plausibility have not yet been proven...

Sensitive data stored in plain text by support-core

support-core has a feature to redact potentially sensitive information in the support bundle. support-core 2.79 and earlier does not redact some sensitive information in the support bundle. This sensitive information can be viewed by anyone with access to the bundle. support-core 2.79.1 adds a li...

Mitsubishi Electric MELSEC iQ-R Improper Access Control (CVE-2020-5656)

Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before,...

CVE-2021-36199: Improper Handling of Syntactically Invalid Structure

Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop...

PT-2021-26827

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.4.294 Description: The issue is related to a use-after-free UAF error in the sata fsl port stop function when the sata fsl module is removed. The actual impact and attack plausibility have not yet been proven...

PT-2021-26859

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.257 Description The issue is related to a use-after-free UAF error in the sata fsl port stop function when the sata fsl module is removed. This error was introduced in version v2.6.24 and fixed in version...