6117 matches found
A Door Isn’t a Door When It’s Ajar- Part 1
A Door Isn’t a Door When It’s Ajar - Part 1 By Trellix · August 11, 2022 This story was also written by Steve Povolny and Sam Quinn Contents Executive Summary Target Selection What is it? Reconnaissance & Standard Operations Recon Standard Operations Hardware Hacking Hardware Hacking Shopping Lis...
Directory Traversal
rsync is vulnerable to Directory Traversal. The vulnerability exists due to a lack of validation of file names allowed, allowing a malicious rsync server or Man-in-The-Middle attacker to overwrite arbitrary files in the rsync client target directory and subdirectories...
Microsoft Exchange Server 安全漏洞
Microsoft Exchange Server is a set of email service programs from Microsoft Corporation USA. It provides mail access, storage, forwarding, voice mail, mail filtering, etc. An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability stems from an incorrect progra...
Adobe Acrobat Reader DC 资源管理错误漏洞
Adobe Acrobat Reader DC is the United States of America Audobee Adobe company of a Pdf reading tool. It is used to reliably view, print and annotate Pdf documents. A resource management error vulnerability exists in Adobe Acrobat Reader DC, which arises from failure to validate the object of an...
Tabnabbing via window.opener [bookwyrm.social]
Description: 1. Hello @bookwyrm-social I found a tabnabbing vulnerability. attack is possible due to taget=blank or Tab nabbing via window.opener. VISIT:- https://bookwyrm.social/ SUMMARY: 1. I was browsing the site and found a tabnabbing vulnerability . As per the observation I found that attack...
OESA-2022-1805 targetcli security update
Targetcli is an administration tool for managing storage targets using the kernel LIO core target and compatible target fabric modules. Security Fixes: Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target and for the backup directory and backup files.CVE-2020-13867...
OESA-2022-1804 targetcli security update
Targetcli is an administration tool for managing storage targets using the kernel LIO core target and compatible target fabric modules. Security Fixes: Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target and for the backup directory and backup files.CVE-2020-13867...
Building Cybersecurity KPIs for Business Leaders and Stakeholders
In the final part of our “Hackers 're Gonna Hack” series, we’re discussing how to bring together parts one and two of operationalising cybersecurity together into an overall strategy for your organisation, measured by key performance indicators KPIs. In part one, we spoke about the problem, which...
CVE-2021-32771
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have...
CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
Open Redirect
firefox is vulnerable to open redirect attacks. The vulnerability exists when using the Performance API which allows an attacker to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect...
India Becomes Top Global Target for API Attacks
An increased adoption of APIs also increases the risk of API attacks. Read about how India has become a top global target for API attacks in 2022...
Cisco Nexus Dashboard Elevation of Privilege Vulnerability (CNVD-2022-54958)
Cisco Nexus Dashboard is the United States Cisco Cisco a single console. It can simplify the operation and management of data center networks. An elevation of privilege vulnerability exists in Cisco Nexus Dashboard that stems from insufficient input validation during CLI command execution. An...
Israeli Spyware Vendor Uses Chrome 0day to Target Journalists
By Deeba Ahmed The spyware vendor Candiru used the Chrome zero-day in March 2022 to target journalists and other unsuspected victims… This is a post from HackRead.com Read the original post: Israeli Spyware Vendor Uses Chrome 0day to Target Journalists...
Apple macOS Monterey Buffer Overflow Vulnerability
Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. Apple macOS Monterey suffers from a buffer overflow vulnerability that originates from a boundary error in the handling of untrusted input in the SMB component, which can be exploited by an...
Malicious code in target-campaign-library (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ff1bba3249e6b5971e433677e17db90e76bf23075833a97f5201115a53d1100 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
New 'Retbleed' Speculative Execution Attack Affects AMD and Intel CPUs
Security researchers have uncovered yet another vulnerability affecting numerous older AMD and Intel microprocessors that could bypass current defenses and result in Spectre-based speculative-execution attacks. Dubbed Retbleed by ETH Zurich researchers Johannes Wikner and Kaveh Razavi, the issue ...
VMware ESXi 安全漏洞
VMware ESXi is a suite of server virtualization platforms from VMware that can be installed directly on physical servers. VMware ESXi ESXi70U1b-17168206 - A security vulnerability exists in ESXi version 670-20211104001, which stems from an unprotected alternative channel to return branch target...