Aggregator

CVE-2026-2682 | Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532) prinReport.html?token=java comid sql injection

Vuldb Updates
3 months 3 weeks ago
A vulnerability classified as critical was found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid leads to sql injection. This vulnerability is uniquely identified as CVE-2026-2682. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-2683 | Tsinghua Unigroup Electronic Archives System 3.2.210802(62532) downLoad.html path path traversal

Vuldb Updates
3 months 3 weeks ago
A vulnerability, which was classified as critical, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). The affected element is an unknown function of the file /Using/Subject/downLoad.html. Performing a manipulation of the argument path results in path traversal. This vulnerability was named CVE-2026-2683. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-2684 | Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532) uploadFile.html File unrestricted upload

Vuldb Updates
3 months 3 weeks ago
A vulnerability, which was classified as critical, was found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The identification of this vulnerability is CVE-2026-2684. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-1999 | GitHub Enterprise Server up to 3.17.10/3.18.4/3.19.1 Pull Request enable_auto_merge authorization (WID-SEC-2026-0460)

Vuldb Updates
3 months 3 weeks ago
A vulnerability identified as problematic has been detected in GitHub Enterprise Server up to 3.17.10/3.18.4/3.19.1. This issue affects the function enable_auto_merge of the component Pull Request Handler. The manipulation leads to incorrect authorization. This vulnerability is documented as CVE-2026-1999. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.
vuldb.com

CVE-2026-26336 | Hyland Alfresco Enterprise/Alfresco Community prior 7.4.2.6/23.6.1/25.3.0 Configuration File /share/page/resource/ authorization

Vuldb Updates
3 months 3 weeks ago
A vulnerability labeled as problematic has been found in Hyland Alfresco Enterprise and Alfresco Community. Affected by this issue is some unknown functionality of the file /share/page/resource/ of the component Configuration File Handler. Executing a manipulation can lead to incorrect authorization. This vulnerability is registered as CVE-2026-26336. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.
vuldb.com

Qilin

Dark Feed IO
3 months 3 weeks ago

You must login to view this content

cohenido

LexisNexis Data Breach — Threat Actor Allegedly Claims 2.04 GB Stolen

Cyber Security News
3 months 3 weeks ago

A threat actor operating under the alias FulcrumSec has publicly claimed responsibility for a fresh breach of LexisNexis Legal & Professional, the legal information division of RELX Group, alleging the exfiltration of 2.04 GB of structured data from the company’s AWS cloud infrastructure. According to FulcrumSec’s post published on March 3, 2026, initial access was […]

The post LexisNexis Data Breach — Threat Actor Allegedly Claims 2.04 GB Stolen appeared first on Cyber Security News.

Guru Baran

CVE-2026-2770 | Mozilla Firefox up to 147 WebIDL use after free (Nessus ID 299964 / WID-SEC-2026-0497)

Vuldb Updates
3 months 3 weeks ago
A vulnerability labeled as critical has been found in Mozilla Firefox up to 147. This issue affects some unknown processing of the component WebIDL. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2026-2770. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.
vuldb.com

CVE-2026-2771 | Mozilla Firefox up to 147 HTML Remote Code Execution (Nessus ID 299906 / WID-SEC-2026-0497)

Vuldb Updates
3 months 3 weeks ago
A vulnerability marked as critical has been reported in Mozilla Firefox up to 147. Impacted is an unknown function of the component HTML Component. The manipulation leads to Remote Code Execution. This vulnerability is documented as CVE-2026-2771. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-2772 | Mozilla Firefox up to 147 Playback use after free (Nessus ID 299964 / WID-SEC-2026-0497)

Vuldb Updates
3 months 3 weeks ago
A vulnerability described as critical has been identified in Mozilla Firefox up to 147. The affected element is an unknown function of the component Playback. The manipulation results in use after free. This vulnerability is reported as CVE-2026-2772. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-2768 | Mozilla Firefox up to 147 IndexedDB sandbox (Nessus ID 299964 / WID-SEC-2026-0497)

Vuldb Updates
3 months 3 weeks ago
A vulnerability categorized as critical has been discovered in Mozilla Firefox up to 147. This affects an unknown part of the component IndexedDB. Such manipulation leads to sandbox issue. This vulnerability is listed as CVE-2026-2768. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-2769 | Mozilla Firefox up to 147 IndexedDB use after free (EUVD-2026-8469 / Nessus ID 299892)

Vuldb Updates
3 months 3 weeks ago
A vulnerability identified as critical has been detected in Mozilla Firefox up to 147. This vulnerability affects unknown code of the component IndexedDB. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-2769. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.
vuldb.com

Microsoft Warns of New Phishing Attack Exploiting OAuth in Entra ID to Evade Detection

Cyber Security News
3 months 3 weeks ago

A new active phishing attack that exploits OAuth’s legitimate redirection behavior, allowing it to bypass traditional email and browser defenses without stealing any tokens. According to Microsoft Defender researchers, the campaigns primarily target government and public-sector organizations, using trusted identity provider domains to mask malicious redirects. Unlike traditional phishing that relies on credential theft or […]

The post Microsoft Warns of New Phishing Attack Exploiting OAuth in Entra ID to Evade Detection appeared first on Cyber Security News.

Guru Baran

Managed ad