2177 matches found
“Nearly all” AT&T customers had phone records stolen in new data breach disclosure
In a déjà-vu nightmare, US phone giant AT&T has notified customers that cybercriminals managed to download phone call and text message records of "nearly all of AT&T cellular customers from May 1, 2022 to October 31, 2022 as well as on January 2, 2023". In a filing with the Securities and Exchang...
AT&T Discloses Breach of Customer Data
On July 12, AT&T released a public statement on unauthorized access of customer data from a third-party cloud platform. AT&T also provided recommendations and resources for affected customers. CISA encourages customers to review the following AT&T article for additional information and follow...
The vulnerability of Parasolid’s 3D geometric modeling tool, related to the swapping of the zero pointer, allows a hacker to trigger a service failure.
The vulnerability of Parasolid’s 3D geometric modeling tool is related to the manipulation of the zero pointer. Exploiting this vulnerability can allow attackers to trigger a service failure using specially created XT files...
CVE-2024-37247
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in twinpictures, baden03 jQuery T- Countdown Widget allows Stored XSS.This issue affects jQuery T- Countdown Widget: from n/a through 2.3.25...
CVE-2024-23146
A maliciously crafted XB and XT file, when parsed in pskernel.DLL through through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current...
WordPress jQuery T(-) Countdown Widget Plugin <= 2.3.25 is vulnerable to Cross Site Scripting (XSS)
Software jQuery T- Countdown Widget Type Plugin Vulnerable versions = 2.3.25 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37247 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8be8473580c0 Credits LVT-tholv2k Required privile...
A week in security (June 17 – June 23)
Last week on Malwarebytes Labs: Microsoft Recall delayed after privacy and security concerns Almost everything you always wanted to know about cybersecurity, but were too afraid to ask, with Tjitske de Vries: Lock and Code S05E13 43% of couples experience pressure to share logins and locations,...
Wireshark Security Update (wnpa-sec-2024-06) - Windows
Wireshark is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark";...
Was T-Mobile compromised by a zero-day in Jira?
A moderator of the notorious data breach trading platform BreachForums is offering data for sale they claim comes from a data breach at T-Mobile. The moderator, going by the name of IntelBroker, describes the data as containing source code, SQL files, images, Terraform data, t-mobile.com...
WordPress Accordions plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jean Tirstan T Patchstack Alliance in WordPress Plugin Accordions versions = 2.3.5...
WordPress My Favorites plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jean Tirstan T in WordPress Plugin My Favorites versions = 1.4.3...
PT-2024-14315 · Libcoap +2 · Libcoap +2
Name of the Vulnerable Software and Affected Versions: Libcoap version v.a3ed466 obgm affected versions not specified Description: An issue in Libcoap and obgm allows a remote attacker to cause a denial of service via the coap context t function in the src/coap threadsafe.c component...
CVE-2024-5653
A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has...
CVE-2024-5653
A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has...
CVE-2024-5653
CVE-2024-5653 affects Chanjet Smooth T+system 3.5. The SQL injection vulnerability arises from insecure handling of the KeyID parameter in /tplus/UFAQD/keyEdit.aspx, enabling remote exploitation. Multiple sources corroborate the issue and indicate public exploitation may be possible. Remediation ...
CVE-2024-5653 Chanjet Smooth T+system keyEdit.aspx sql injection
A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has...
CVE-2024-5653 Chanjet Smooth T+system keyEdit.aspx sql injection
A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has...
PT-2024-36833
Name of the Vulnerable Software and Affected Versions Chanjet Smooth T+ system version 3.5 Description A critical issue has been found in the system, affecting the processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the KeyID argument leads to SQL injection. The attack can be...
Chanjet Smooth T+system SQL Injection Vulnerability
Chanjet Smooth T+system is an enterprise management software from China's Changjitong Chanjet, which is mainly for small and medium-sized enterprises, providing comprehensive solutions for finance, business, production and supply chain management. The system is designed to help enterprises realiz...
CVE-2024-4783 jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode
The jQuery T- Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...