2436 matches found
Beneath the surface: Uncovering the shift in web skimming
Microsoft security researchers recently observed that web skimming campaigns now employ various obfuscation techniques to deliver and hide skimming scripts. It’s a shift from earlier tactics where attackers conspicuously injected malicious scripts into e-commerce platforms and content management...
U.S. Dept Of Defense: Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)
The vulnerability exposed private personal information of soldiers, including their last four digits of Social Security number, home of record, military occupation specialty, and school records, to unauthorized users on the https://█████████/SelfService/home/selfservice website. The vulnerability...
Code injection
A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 may be used to write beyond the allocated buffer while parsing PICT, BMP, PSD or TIF file. This vulnerability may be exploited to execute arbitrary code...
CVE-2022-0784
creationtimestamp| type| source ---|---|--- 2022-03-28 22:41:50+00:00| seen| https://t.me/cibsecurity/39664 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-01-26 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities -...
The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to authentication errors, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Magento Commerce development and management software platform is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
Post-Auth OS Command Injection vulnerability Impacting End-Of-Life SRA Appliances and End-Of-Support SMA100 firmware versions
NOTE: SonicWall PSIRT has observed threat actors targeting EOL SRA devices CVE-2021-20028, and active exploitation of this vulnerability is likely.SonicWall is aware of a ‘Post Authentication OS Command Injection’ vulnerability, reported by Compass Security, impacting end-of-life Secure Remote...
CVE-2021-27416
An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management EAM versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of...
Microsoft Azure Defender for IoT Password Change Command Injection Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Azure Defender for IoT. An attacker must first obtain the ability to execute code as the www-data user on the target system in order to exploit this vulnerability. The specific flaw exists with...
The vulnerability of NETGEAR XR1000 router’s built-in software lies in the lack of protection for service data, which allows attackers to exploit this weakness to disclose protected information.
The vulnerability of NETGEAR XR1000 router’s built-in software lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...
Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs
In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...
Medium: java-11-amazon-corretto
Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to...
Russian state-sponsored cyber actors targeting U.S. critical infrastructure
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here In a joint cybersecurity advisory, the Federal Bureau of Investigation FBI, the National Security Agency NSA, the Cybersecurity and Infrastructure Security Agency CISA revealed that Russian state-sponsored threat actors target...
CVE-2022-23204 Adobe Premiere Rush JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Premiere Rush versions 2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a vict...
CVE-2021-37107
There is an improper memory access permission configuration on ACPU.Successful exploitation of this vulnerability may cause out-of-bounds access...
CVE-2022-23592 Out of bounds read in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a DCHECK which is a no-op during production. An attacker can control the inputidx variable such that ix would be larger than the number of...
ROS-20220125-14
Lxml library vulnerability is related to insufficient cleansing of user data in the cleanup program HTML in the lxml.html file. Exploitation of the vulnerability could allow an attacker acting remotely to cause a victim to click on a specially crafted link and execute arbitrary HTML code and scri...
CVE-2021-40404
An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2021-43752 Adobe Illustrator TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Illustrator versions 25.4.2 and earlier and 26.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...
