4255 matches found
CVE-2022-44631
Auth. author+ Stored Cross-Site Scripting XSS vulnerability in 1app Technologies, Inc 1app Business Forms plugin = 1.0.0 versions...
CVE-2022-44631
The CVE-2022-44631 entry concerns the WordPress 1app Business Forms plugin ≤ 1.0.0, with an Authenticated Stored XSS vulnerability in the author+ flow. Public sources consistently show the issue stems from insufficient sanitisation/escaping of parameters, enabling stored XSS when a user with auth...
CVE-2022-44631 WordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. author+ Stored Cross-Site Scripting XSS vulnerability in 1app Technologies, Inc 1app Business Forms plugin = 1.0.0 versions...
N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX
The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors. Google-owned Mandiant, which is tracking the attack event under the moniker UNC4736 , said the...
AVG Technologies AVG Antivirus 代码问题漏洞
AVG Technologies AVG Antivirus is a suite of antivirus software from the Czech company AVG Technologies. A security vulnerability exists in AVG Technologies AVG Antivirus that stems from a NULL pointer dereference issue with the RPC interface...
Google Uncovers APT41's Use of Open Source GC2 Tool to Target Media and Job Sites
A Chinese nation-state group targeted an unnamed Taiwanese media organization to deliver an open source red teaming tool known as Google Command and Control GC2 amid broader abuse of Google's infrastructure for malicious ends. The tech giant's Threat Analysis Group TAG attributed the campaign to ...
Binary Vulnerability in GR1108-P of Xinhua San Technologies Ltd.
The GR1108-P is a Gigabit wireless enterprise-class routing device manufactured by Xinhua San Technologies H3C. A binary vulnerability exists in the Xinhua San Technologies GR1108-P, which can be exploited by an attacker to gain control of the server...
Exploit for CVE-2023-31497
EPScalate An elevation of privilege vulnerability in QuickHeal...
CISA Warns of Critical ICS Flaws in Hitachi, mySCADA, ICL, and Nexx Products
The U.S. Cybersecurity and Infrastructure Security Agency CISA has published eight Industrial Control Systems ICS advisories warning of critical flaws affecting products from Hitachi Energy, mySCADA Technologies, Industrial Control Links, and Nexx. Topping the list is CVE-2022-3682 CVSS score: 9....
Deserialization Vulnerability in U8 Cloud of UFIDA Network Technologies Co.
U8 Cloud is a digital platform for enterprises to go to the cloud, integrating transactions, services and management into a total ERP solution. A deserialization vulnerability exists in UFIDA U8 Cloud, which can be exploited by attackers to remotely execute commands...
Keysight N6845A Geolocation Server
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Keysight Technologies Equipment: N6854A Geolocation Sever Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate privileges in...
Breaking the Mold: Pen Testing Solutions That Challenge the Status Quo
Malicious actors are constantly adapting their tactics, techniques, and procedures TTPs to adapt to political, technological, and regulatory changes quickly. A few emerging threats that organizations of all sizes should be aware of include the following: Increased use of Artificial Intelligence a...
ZKTeco ZEM/ZMM 8.88 - Missing Authentication
Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication Exploit Author: RedTeam Pentesting GmbH CVE: CVE-2022-42953 Advisory: Missing Authentication in ZKTeco ZEM/ZMM Web Interface The ZKTeco time attendance device does not require authentication to use the web interface, exposing the databas...
CVE-2023-24835
Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service...
Code injection
Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service...
CVE-2023-24835 Softnext SPAM SQR - Code Injection
Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service...
CVE-2023-24835 Softnext SPAM SQR - Code Injection
Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service...
PT-2023-19815 · Softnext Technologies · Spam Sqr
Name of the Vulnerable Software and Affected Versions: Softnext Technologies Corp.’s SPAM SQR affected versions not specified Description: The issue concerns a Code Injection vulnerability within a specific function of the software. An authenticated remote attacker with administrator privilege ca...
SPAM SQR 代码注入漏洞
Softnext Technologies SPAM SQR is a comprehensive email filtering platform from China-based Softnext Technologies. A code injection vulnerability exists in SPAM SQR versions prior to 2.221231, which stems from a code injection flaw. An attacker can exploit this vulnerability to execute system...
