Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString. CVSSv3.1 9.8 (CRITICAL) · EPSS 56th percentile
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation. CVSSv3.1 9.0 (CRITICAL) · EPSS 49th percentile
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser. CVSSv3.1 9.0 (CRITICAL) · EPSS 57th percentile
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b9 CVSSv3.1 8.0 (HIGH) · EPSS 81th percentile
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec. CVSSv3.1 9.8 (CRITICAL) · EPSS 69th percentile
ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada. CVSSv3.1 9.0 (CRITICAL) · EPSS 59th percentile
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead t CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. CVSSv3.1 9.1 (CRITICAL) · EPSS 52th percentile
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106. CVSSv3.1 9.6 (CRITICAL) · EPSS 60th percentile
Fusiondirectory 1.3 suffers from Improper Session Handling. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
Elastic Security Labs published detection rules for CVE-2020-1350 (SIGRed), a critical heap-based buffer overflow in Windows DNS Server affecting all versions from 2003–2019. The vulnerability enables unauthenticated remote code execution via malformed DNS requests and was patched by Microsoft in July 2020. The post provides three detection strategies: endpoint-based rules for suspicious dns.exe child processes and file modifications, and network-based rules identifying abnormally large DNS responses (>60KB) that trigger the overflow.
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with subscriber level permissions and above to inject a PHP Object CVSSv3.1 8.8 (HIGH) · EPSS 89th percentile
Elastic Security Labs analyzed the REF4526 intrusion set, which uses a multi-stage attack chain leveraging Unicode icon obfuscation in PowerShell scripts to deliver the YIPPHB dropper and RAT implants (NJRAT, LIMERAT, ASYNCRAT). The attack chain spans from initial loader delivery via TinyURL/Discord CDN, through a dropper phase, to final RAT deployment, with 12 identified activity clusters dating back to May 2022. The research includes automated extraction techniques and EQL/shell-script-based hunting queries for detection and analysis.
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information. CVSSv3.1 8.2 (HIGH) · EPSS 65th percentile
The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing or incorrect nonce validation on the extra_actions function. This makes it possible for unauthenticated attackers to change plugin settings including permalinks and site maps, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 37th percentile
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs. CVSSv3.1 8.6 (HIGH) · EPSS 78th percentile
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile
A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of HostScan data received from the Posture (HostScan) module. An attacker could exploit this vulnerability by sending crafted HostSc CVSSv3.1 8.6 (HIGH) · EPSS 55th percentile
A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory handling error that occurs when GRE traffic is processed. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit c CVSSv3.1 8.6 (HIGH) · EPSS 55th percentile
The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL. CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute. CVSSv3.1 9.8 (CRITICAL) · EPSS 53th percentile