CVE-2022-1864

Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction...

CVE-2022-23000

The Western Digital My Cloud Web App https://os5.mycloud.com/ uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation,...

Western Digital My Cloud 安全漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in the Western Digital My Cloud Web App. An attacker could exploit the vulnerability to compromise the integrity, confidentiality, and authenticity of transmitted information...

PT-2022-4256 · Western Digital · Western Digital My Cloud Web App

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Web App affected versions not specified Description: The issue is related to the use of a weak SSLContext in the Western Digital My Cloud Web App when configuring port forwarding rules. This weakness is due to the use...

rbtm 路径遍历漏洞

rbtm is a web application for performing computerized tomography experiments by the individual developer meerstein in Russia. A security vulnerability exists in rbtm version 1.5 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

PT-2022-21677 · Unknown · Zoo Management System

Name of the Vulnerable Software and Affected Versions: Zoo Management System version 1.0 Description: A stored cross-site scripting XSS issue in the Add Classification function allows attackers to execute arbitrary web scripts or HTML via unspecified vectors. This could potentially lead to the...

The vulnerability in the LDAP Account Manager web application, related to the lack of measures taken to protect confidential information, allows a perpetrator to obtain LDAP authentication credentials.

The vulnerability in the LDAP Account Manager web application relates to the lack of measures taken to protect confidential information. Exploiting this vulnerability could allow a perpetrator to obtain LDAP authentication credentials...

Malicious code in 1uphealth-demo-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48e9160c131034f957f1b96525b7b55a425dac218da246a585fa8bc8c00e3628 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-22 Malicious code in 1uphealth-demo-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48e9160c131034f957f1b96525b7b55a425dac218da246a585fa8bc8c00e3628 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in giphy-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ce852d61afc6e95150c73143e32f931a8811bfbf6215d8d1ac2a184d615162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3365 Malicious code in giphy-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ce852d61afc6e95150c73143e32f931a8811bfbf6215d8d1ac2a184d615162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in oppo_web_app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a66462bc2faa705271df67a558a3ebd69bf8efb3fcd4095584142ac28a1a4d1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in circle-admin-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f76a2bc0c0f563c74e8f1cf6ead555272deba5738524e1f4ee893708391de3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1904 Malicious code in circle-admin-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f76a2bc0c0f563c74e8f1cf6ead555272deba5738524e1f4ee893708391de3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Advanced School Management System SQL注入漏洞

Advanced School Management System is an open source PHP and MySQL based school management system. advanced School Management System is vulnerable to SQL injection in version v1.0, which can be exploited by attackers to launch SQL attacks against targets...

CVE-2022-30813

elitecms 1.01 is vulnerable to SQL Injection via /admin/addpost.php...

Denial Of Service (DoS)

chromium is vulnerable to denial of service. An attacker can crash the application through the use after free in web app installs component...

Cisco UCS Director JavaScript Cross-Site Scripting Vulnerability

A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom...

Sysrv botnet is out to mine Monero on your Windows and Linux servers

In a Twitter thread, the Microsoft Security Intelligence team have revealed new information about the latest versions of the Sysrv botnet. The variant they focused on uses a range of known exploits for vulnerabilities in web apps and databases to install cryptocurrency miners on both Windows and...

Cross-Site Request Forgery (CSRF)

Summary: Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. ... If the victim is an administrative account, CSRF can compromise the entire web application. Steps To Reproduce: 1.Create a...