CVE-2022-34259 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature...

Improper Authorization lead a user add an arbitrary agent into Team

Description A Vulnerability in edit team function lead an user add another user via ID to Team, alternatively know the email of every user in Chatwoot Step to reproduce - login to the app -navigate to the Team setting: https://app.chatwoot.com/app/accounts/id/settings/teams/list -Create new or ed...

The vulnerability of the Microsoft Exchange Server mail server, related to deficiencies in access control, allows attackers to disclose protected information.

The vulnerability of Microsoft Exchange Server servers is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

#StopRansomware: MedusaLocker

Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce multifactor authentication. Note: this joint Cybersecurity Advisory CSA is part of an...

PT-2022-4159 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to an information disclosure vulnerability. It may allow a remote attacker to gain unauthorized access to protected information. The vulnerability can...

Hostname Spoofing

Description parse-url parses following https url incorrectly, identifies its protocol as ssh, and its host name is parsed incorrectly either. https://www.google.com:[email protected]:x node -e 'const parseUrl=require"parse-url";console.logparseUrl"https://www.google.com:[email protected]:x"' protocols:...

PT-2022-22204 · Unknown · Barangay Management System

Name of the Vulnerable Software and Affected Versions: Barangay Management System version 1.0 Description: A SQL injection issue was found in the Barangay Management System. The vulnerability can be exploited via the hidden id parameter at the "/pages/permit/permit.php" API endpoint...

WordPress Social Share Buttons SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Social Share Buttons 2.2.3 and prior versions, which stems from the application's lack of...

CVE-2022-2487

creationtimestamp| type| source ---|---|--- 2022-07-20 16:19:56+00:00| seen| https://t.me/cibsecurity/46638 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-02-08 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-02-08...

CVE-2022-2396 SourceCodester Simple e-Learning System claire_blake cross site scripting

A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claireblake. The manipulation of the argument Bio with the input "alertdocument.cookie leads to cross site scripting. The...

HackerOne insider fired for trying to claim other people’s bounties

The vulnerability disclosure platform HackerOne has revealed that one of their staff members had improperly accessed security reports for personal gain. The—now former—staff member approached HackerOne customers with vulnerabilities that belonged to users of the platform. HackerOne HackerOne acts...

CVE-2021-39793

creationtimestamp| type| source ---|---|--- 2022-07-04 20:00:05+00:00| seen| https://t.me/truesecator/3129 2022-09-08 13:17:27+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6761 2022-11-22 21:05:00+00:00| seen|...

The vulnerability of the Citrix Application Delivery Management (ADM) delivery service lies in the insufficient control over resources during its existence. This allows a malicious actor to cause a temporary interruption of the ADM licensing service.

The vulnerability of the Citrix Application Delivery Management ADM delivery management service is related to insufficient control over resources during its existence. Exploiting this vulnerability could allow a malicious actor to cause a temporary disruption in the ADM licensing service’s...

Taker can provide several instances of the cheapest ERC-1155 item in a multi item bundle

Lines of code Vulnerability details Maker bid for a bundle of ERC-1155 items can be tricked into successful execution by providing several instances of the cheapest item instead of the required bundle. This way a malicious taker can receive full maker's price, providing several instances of the...

Siemens EN100 Ethernet module 缓冲区错误漏洞

Siemens EN100 Ethernet Module is an Ethernet module product from Siemens, Germany. Siemens EN100 Ethernet module is vulnerable to a memory corruption vulnerability that can be exploited by attackers to crash affected applications, resulting in a denial-of-service condition...

People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Summary Best Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China PRC state-sponsored...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

This is a PoC exploit for CVE-2021-44228, a vulnerability in the...

State-Backed Hackers Exploit Microsoft 'Follina' Bug to Target Entities in Europe and U.S

A suspected state-aligned threat actor has been attributed to a new set of attacks exploiting the Microsoft Office "Follina" vulnerability to target government entities in Europe and the U.S. Enterprise security firm Proofpoint said it blocked attempts at exploiting the remote code execution flaw...

GHSA-94WQ-87G6-8H77 Magento Open Source allows Cross-Site Request Forgery (CSRF)

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to a customer's cart by an unauthenticated attacker. Acces...

Beneath the surface: Uncovering the shift in web skimming

Microsoft security researchers recently observed that web skimming campaigns now employ various obfuscation techniques to deliver and hide skimming scripts. It’s a shift from earlier tactics where attackers conspicuously injected malicious scripts into e-commerce platforms and content management...