An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint. This allows remote attackers to bypass intended access restrictions, or to trigger denial of service to traffic directed to co-dependent.....
9.1CVSS
9AI Score
0.003EPSS
Securing our home labs: Home Assistant code review
Introduction In July, the GitHub Security Lab team conducted a collaborative review of one of our favorite software pieces. While it's not uncommon for our Security Lab researchers to work together on audits and research projects, we found that conducting team audits occasionally provides a...
9CVSS
8.1AI Score
0.001EPSS
Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine
A coordinated law enforcement operation has led to the arrest of key individuals in Ukraine who are alleged to be a part of several ransomware schemes. "On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne, and Vinnytsia, resulting in the arrest of the 32-year-old...
7.6AI Score
An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via the password parameter in the login...
5.5AI Score
0.001EPSS
Authentication Bypass in ADOdb/ADOdb
Impact An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes. Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc. Patches...
9.1CVSS
0.4AI Score
0.004EPSS
Franklin Electric Fueling Systems Colibri
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Franklin Electric Fueling Systems Equipment: Colibri Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...
6.5CVSS
7.3AI Score
0.001EPSS
XSS Vulnerability in the Online Platform of Beijing MUHUA Information Technology Co.
Beijing Muhua Information Technology Co., Ltd. is an enterprise mainly engaged in software and information technology service industry. XSS vulnerability exists in the online platform of Beijing MUHUA Information Technology Co. Ltd.'s Academy, which can be exploited by attackers to obtain...
5.8AI Score
Shanghai Shangtang Intelligent Technology Co., Ltd. currently covers four business segments: Smart Business, Smart City, Smart Life, and Smart Car. Shanghai Shangtang Intelligent Technology Co., Ltd. SenseLink Intelligent Internet of Things platform has a command execution vulnerability that can...
7.6AI Score
Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted...
3.5CVSS
5AI Score
0.0004EPSS
Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted...
3.5CVSS
4.7AI Score
0.0004EPSS
[SECURITY] Fedora 39 Update: grafana-pcp-5.1.1-4.fc39
This Grafana plugin for Performance Co-Pilot includes data sources for scalable time series from pmseries(1) and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace(1), as well as several...
7.3AI Score
Binary Vulnerability in R230 of Xinhua San Technologies Ltd.
The H3C R230 is a home wireless router. A binary vulnerability exists in the H3C-R230 of Xinhua San Technologies Limited, which can be exploited by attackers to trigger a stack...
7AI Score
The "Blue Ridge Bank and Trust Co. Mobile Banking" by Blue Ridge Bank and Trust Co. app 3.0.1 -- aka blue-ridge-bank-and-trust-co-mobile-banking/id699679197 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive...
5.9CVSS
5.2AI Score
0.001EPSS
Zhejiang Zhongcheng Technology Co., Ltd. is a total solution provider of intelligent manufacturing for the process industry. An arbitrary file deletion vulnerability exists in the Intelligent Mobile Monitoring System of Zhejiang Zhongcheng Technology Co. Ltd, which can be exploited by...
7.3AI Score
CVE-2022-47442 WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection
Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through...
8.9AI Score
0.001EPSS
Unauthorized Access Vulnerability in MOXA E1242 Ethernet IO Server
Mosa Technologies (Shanghai) Co., Ltd. is a company mainly engaged in professional and technical services. An unauthorized access vulnerability exists in MOXA E1242 Ethernet IO Server, which can be exploited by attackers to obtain sensitive...
6.8AI Score
In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with System execution privileges...
6.7CVSS
6.7AI Score
0.0004EPSS
Microsoft named a Leader in 2023 Gartner® Magic Quadrant™ for Access Management for the 7th year
Protecting identity from compromise is top of mind for security professionals as identity attacks continue to intensify. Earlier this year we reported that we had observed a nearly three-fold increase in password attacks per second in the last two years, from 579 in 2021 to 4,000 in 2023.1...
7.2AI Score
Microsoft named a Leader in 2023 Gartner® Magic Quadrant™ for Access Management for the 7th year
Protecting identity from compromise is top of mind for security professionals as identity attacks continue to intensify. Earlier this year we reported that we had observed a nearly three-fold increase in password attacks per second in the last two years, from 579 in 2021 to 4,000 in 2023.1...
7.1AI Score
In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.3AI Score
0.0004EPSS
Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information...
7.5CVSS
7.5AI Score
0.002EPSS
Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability. An attacker could exploit this vulnerability to access the serial interface and modify the configuration. Successful exploit could lead to the authentication bypass and view...
7.5CVSS
7.6AI Score
0.002EPSS
Scanning Danger: Unmasking the Threats of Quishing
Scanning Danger: Unmasking the Threats of Quishing By Shyava Tripathi, Raghav Kapoor and Rohan Shah · December 07, 2023 Phishing, a prevalent cybercrime worldwide, is responsible for as much as 90 percent of data breaches, making it a significant avenue for the theft of sensitive credentials and...
7.4AI Score
[SECURITY] Fedora 39 Update: mvfst-2023.10.16.00-1.fc39
mvfst (Pronounced move fast) is a client and server implementation of IETF QU IC protocol in C++ by Facebook. QUIC is a UDP based reliable, multiplexed transp ort protocol that will become an internet standard. The goal of mvfst is to build a performant implementation of the QUIC transport...
7.5CVSS
8.5AI Score
0.732EPSS
Scanning Danger: Unmasking the Threats of Quishing
Scanning Danger: Unmasking the Threats of Quishing By Shyava Tripathi and Rohan Shah · December 7, 2023 This blog was also written by Raghav Kapoor Phishing, a prevalent cybercrime worldwide, is responsible for as much as 90 percent of data breaches, making it a significant avenue for the theft...
7.4AI Score
Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL...
9.8CVSS
9.7AI Score
0.002EPSS
Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL...
9.8CVSS
9.8AI Score
0.002EPSS
Buffer Overflow Vulnerability in H3C B6 of Xinhua San Technologies Co.
H3C B6 Gigabit Dual Band Router is a newly designed Wi-Fi 6 home wireless intelligent router from Xinhua San Intelligent Terminal Co. A buffer overflow vulnerability exists in the H3C B6 of Xinhua San Technologies Limited, which can be exploited by an attacker to trigger a stack...
7.6AI Score
The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to...
5.4CVSS
5.5AI Score
0.001EPSS
Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line...
5.8AI Score
0.006EPSS
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious...
9.8CVSS
0.125EPSS
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious...
9.8CVSS
9.9AI Score
0.125EPSS
The pduread function in pdu.c in libpcp in Performance Co-Pilot (PCP) before 3.6.5 does not properly time out connections, which allows remote attackers to cause a denial of service (pmcd hang) by sending individual bytes of a PDU separately, related to an "event-driven programming...
6.2AI Score
0.049EPSS
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series),.....
5.4CVSS
5.2AI Score
0.0005EPSS
Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative type value to the...
6.3AI Score
0.094EPSS
Anhui Green Persimmon Information Technology Co., Ltd LiveGBS has information leakage vulnerability
LiveGBS is a national standard (GB28181) streaming media service software , can provide to provide user management and Web visualization page management , open source front-end page source code ; to provide device status management , you can real-time view of whether the device is offline and...
6.8AI Score
Microsoft Patch Tuesday, November 2023 Edition
Microsoft today released updates to fix more than five dozen security holes in its Windows operating systems and related software, including three "zero day" vulnerabilities that Microsoft warns are already being exploited in active attacks. The zero-day threats targeting Microsoft this month...
8.8CVSS
7.7AI Score
0.005EPSS
Impact There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a...
6.1CVSS
6AI Score
0.0004EPSS
Anhui Green Persimmon Information Technology Co., Ltd. LiveQing has a logic flaw vulnerability
LiveQing Aoki video streaming service solution. Anhui Green Persimmon Information Technology Co., Ltd LiveQing has a logic flaw vulnerability that can be exploited by attackers to delete arbitrary...
7.2AI Score
ClearFake Campaign Expands to Target Mac Systems with Atomic Stealer
The macOS information stealer known as Atomic is now being delivered to target via a bogus web browser update chain tracked as ClearFake. "This may very well be the first time we see one of the main social engineering campaigns, previously reserved for Windows, branch out not only in terms of...
6.8AI Score
Grav Server-side Template Injection (SSTI) via Twig Default Filters
Hi, actually we have sent the bug report to [email protected] on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection (SSTI) via Twig Default Filters Summary: | Product | Grav CMS | | ----------------------- |...
8.8CVSS
8.9AI Score
EPSS
In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges...
4.4CVSS
4.8AI Score
0.0004EPSS
In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.3AI Score
0.0004EPSS
HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an...
6.1CVSS
6.2AI Score
0.0005EPSS
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.2AI Score
0.0004EPSS
In faceid service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution...
5.5CVSS
5.5AI Score
0.0004EPSS
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.2AI Score
0.0004EPSS
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.2AI Score
0.0004EPSS
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.2AI Score
0.0004EPSS
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...
5.5CVSS
5.2AI Score
0.0004EPSS