Share

RSS

More Articles…

• From Cyberfero to Cyberfero: rebranding of the leading cybersecurity company
• NIS: what it is and how it protects cybersecurity
• Advanced persistent threats (APTs): what they are and how to defend yourself
• Penetration Testing and MFA: A Dual Strategy to Maximize Security
• Penetration Testing: Where to Strike to Protect Your IT Network
• Ransomware: a plague that brings companies and institutions to their knees. Should you pay the ransom? Here is the answer.
• Why IT audit and log management are important for Cybersecurity
• Red Team, Blue Team and Purple Team: what are the differences?

Categories …

• Backup as a Service (18)
  • Acronis Cloud Backup (11)
  • Veeam Cloud Connect (4)
• Cloud Conference (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Cyberfero (15)
• ICT Monitoring (5)
• Log Management (2)
• News (25)
• ownCloud (4)
• Privacy (7)
• Security (203)
  • Cyber Threat Intelligence (CTI) (8)
  • Deception (4)
  • Ethical Phishing (11)
  • Netwrix Auditor (2)
  • Penetration Test (11)
  • Posture Guard (3)
  • SOCaaS (65)
    • EDR (3)
    • SIEM (13)
    • SOAR (5)
    • UEBA (10)
  • Vulnerabilities (84)
• Web Hosting (15)

Tags

Unknown Feed

Full Disclosure

• [0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in StreamSets Transformer, the Spark-engine data-pipeline platform from StreamSets Inc. (subsequently acquired by IBM), verified on version 3.17.0 analysed from the official container image. Type: failing-open authentication plus un-sandboxed code injection. On the web tier, CWE-306 and CWE-1188 with […]
• [0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in RCDevs WebADM 2.4.14, Freeware Edition, the closed-source IAM/MFA management platform from RCDevs Security SA (Luxembourg) that fronts the vendor's OpenOTP, SpanKey and TiQR authentication products. Type: OS command injection (CWE-78, with CWE-20 and CWE-116 contributing, and CWE-732/CWE-276 and […]
• [0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in Maian Cart 3.8, the self-hosted PHP shopping-cart system from Maian Media (Maian Script World), verified end to end against a real installation of that version. Type: unrestricted upload of a file with a dangerous type (CWE-434), realized as […]
• [0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in IPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0. Type: OS command injection (CWE-78, with CWE-20 bearing on it because no character validation exists anywhere on the path; CWE-250 bears on the result). The server property package.dnf.repo.gpg_key, the […]
• [0day-rubbish] Circutor LineEds 24.11.14-r0 unauthenticated pwrstudio events.xml shellExecute command injection (9.8) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in the pwrstudio daemon shipped in Circutor LineEds (Line Energy Data System) industrial energy gateway firmware 24.11.14-r0, engine variant pss0. Circutor S.A. is in Spain; the appliance sits between metering and power-quality instrumentation on one side and an energy-management […]
• [0day-rubbish] Asustor ADM 3.5.9.RWM1 (AS602T) music.cgi act=live stored-filename command injection reaching system() (8.8 primary, PR:L) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in the media handler of the ADM (ASUSTOR Data Master) management portal, verified by static analysis on the AS602T running ADM 3.5.9.RWM1 (x86-64, first- generation G1 firmware line, from the distributed image ADM_X64_G1_3.5.9.RWM1_AS602T.img). Type: OS command injection (CWE-78), enabled […]
• [0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8) October 6, 2026
  Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in Advantech WebAccess Node 9.2.3, the closed-source industrial SCADA/HMI web server from Advantech (Taiwan). Type: unrestricted file upload (CWE-434) compounded by path traversal (CWE-22), on a page that performs no authorization decision at all (CWE-306). CWE-73 and CWE-862 also […]
• SEC Consult Research 20261001 :: Arbitrary Email sender spoofing in Apple iCloud mail October 6, 2026
  Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 06SEC Consult Vulnerability Lab Research Announcement < 20261001 > ======================================================================= title: Arbitrary Email sender spoofing in Apple iCloud mail product: Apple iCloud mail (SMTP submission service) vulnerable version: iCloud mail infrastructure (cloud service) fixed version: Fixed by Apple (verified by SEC Consult, 2025-12-09) CVE number: […]
• SEC Consult SA-20260924-0 :: Multiple Vulnerabilities in Paessler PRTG Network Monitor #CVE-2026-4637 #CVE-2026-4638 October 6, 2026
  Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 06SEC Consult Vulnerability Lab Security Advisory < 20260924-0 > ======================================================================= title: Multiple Vulnerabilities product: Paessler PRTG Network Monitor vulnerable version:
• [NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read October 1, 2026
  Posted by advisories on Sep 30---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0019 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the VGM command interpreter of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to read heap memory past the end of the buffer...