K11315080: OpenSSH vulnerability CVE-2018-20685

Security Advisory Description In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. CVE-2018-20685 Impact The OpenSSH...

Is your FIM Solution Cost and Time Efficient?

Virtually every security professional and corporate executive is painfully aware of recent escalations in cybersecurity threats. No one wants to be a headline or get hit with the typical $4.5 million price tag to remediate an incident IBM Study. Almost every security team will agree that file...

GitHub Breach: Hackers Stole Code-Signing Certificates for GitHub Desktop and Atom

GitHub on Monday disclosed that unknown threat actors managed to exfiltrate encrypted code signing certificates pertaining to some versions of GitHub Desktop for Mac and Atom apps. As a result, the company is taking the step of revoking the exposed certificates out of abundance of caution. The...

Google Android 安全漏洞

Google Android is a Linux-based open-source operating system from Google, Inc. A security vulnerability exists in Google Android versions 10, 11, and 12, which stems from a vulnerability in the Car Settings application, where the toggle button to modify system settings is susceptible to...

Command injection

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 SCG200 before 3.6.2.0.795, SmartZone 100 SZ-100 before 3.6.2.0.795, SmartZone 300 SZ300 before 3.6.2.0.795, Virtua...

Full account takeover

Description Account take over via changing email and username and displayed name, After login you and open your settings you can update information ,There is an IDOR here that allows me to change any user email and username and displayed name Proof of Concept...

CVE-2022-2641

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition...

CVE-2022-2641

CVE-2022-2641 affects Horner Automation RCC 972 firmware 15.40, due to a static encryption key on the device. This enables remote changes, potential remote code execution, or DoS. Mitigation: update to RCC 972 firmware 15.60 or later; apply network isolation and standard ICS defenses per CISA ICS...

CVE-2022-2641

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition...

CVE-2022-2641

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition...

CVE-2022-2641

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition...

Race condition

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition...

PT-2022-17828 · Horner Automation · Rcc 972

Name of the Vulnerable Software and Affected Versions: Horner Automation’s RCC 972 version 15.40 Description: The issue is related to a static encryption key on the device, which could allow an attacker to perform unauthorized changes, remotely execute arbitrary code, or cause a denial-of-service...

CVE-2022-3747

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like...

CVE-2022-41839

Broken Access Control vulnerability in WordPress LoginPress plugin = 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings...

PT-2022-25667 · WordPress · Modula

Name of the Vulnerable Software and Affected Versions: Modula plugin versions prior to 2.6.10 Description: The issue allows unauthorized changes to plugin settings. Recommendations: For Modula plugin versions prior to 2.6.10, update to version 2.6.10 or later to resolve the issue...

PT-2022-25292 · Searchwp · Searchwp

Name of the Vulnerable Software and Affected Versions: SearchWP premium plugin versions = 4.2.5 Description: The issue concerns nonce token leakage and missing authorization in the SearchWP premium plugin, allowing unauthorized changes to plugin settings. Recommendations: For SearchWP premium...

WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability leading to unauth. changing of Opt-In or Opt-Out tracking settings discovered by Nguyen Anh Tien Patchstack Alliance in the WordPress LoginPress plugin versions = 1.6.2. Solution Update the WordPress LoginPress plugin to the latest available version at least...

CVE-2022-20962

A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...

Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...