Aggregator

Submit #561794 / VDB-306797

Submit #561764 / VDB-306796

Submit #561760 / VDB-306795

Submit #561746 / VDB-306794

Submit #561737 / VDB-306793

Submit #561552 / VDB-275850

A vulnerability, which was classified as critical, has been found in EasyService Billing 1.0. This issue affects some unknown processing of the file jobcard-ongoing.php. The manipulation of the argument q as part of Parameter leads to sql injection. The identification of this vulnerability is CVE-2018-11444. The attack may be initiated remotely. Furthermore, there is an exploit available.

In a sophisticated business email compromise (BEC) scheme, cybercriminals are targeting tenants with fraudulent requests to redirect rent payments to attacker-controlled bank accounts. The campaign primarily focuses on French-speaking victims in France and occasionally Canada, exploiting the anxiety associated with potential missed rent payments to manipulate targets into immediate action without proper verification. The attacks […]

The post Cybercriminals Deceive Tenants into Redirecting Rent Payments to Fraudulent Accounts appeared first on Cyber Security News.

Alongside its new Meta AI app, Facebook’s parent company launched several new products to help secure open-source AI applications

A vulnerability, which was classified as problematic, has been found in star7th showdoc up to 2.10.3. This issue affects some unknown processing of the component File Upload Handler. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2022-0967. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Adobe Audition up to 14.4. Affected is an unknown function of the component SVG File Parser. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2021-40734. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Adobe Audition up to 14.4. Affected by this vulnerability is an unknown functionality. The manipulation leads to memory corruption. This vulnerability is known as CVE-2021-40735. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Adobe Character Animator up to 4.4. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to out-of-bounds read. This vulnerability was named CVE-2021-40766. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Adobe Character Animator up to 4.4. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to out-of-bounds read. The identification of this vulnerability is CVE-2021-40769. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Adobe Audition up to 14.4 and classified as critical. This vulnerability affects unknown code of the component M4A File Parser. The manipulation leads to memory corruption. This vulnerability was named CVE-2021-40739. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Adobe Audition up to 14.4. Affected by this issue is some unknown functionality. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2021-40736. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Adobe Audition up to 14.4. This affects an unknown part of the component WAV File Parser. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2021-40738. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

CISA released two Industrial Control Systems (ICS) advisories on May 1, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

• ICSA-25-121-01 KUNBUS GmbH Revolution Pi
   
• ICSMA-25-121-01 MicroDicom DICOM Viewer

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

• CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability
• CVE-2023-44221 SonicWall SMA100 Appliances OS Command Injection Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

A vulnerability was found in Adobe Audition up to 14.4 and classified as critical. This issue affects some unknown processing of the component M4A File Parser. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2021-40740. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.