3988 matches found
CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...
CVE-2024-23493
CVE-2024-23493 affects Mattermost Mattermost server; root cause is improper authorization when fetching team-associated AD/LDAP groups, allowing non-members to retrieve details of a team’s AD/LDAP groups. Impact is exposure of group details (confidentiality). Some sources reference affected versi...
CentOS 9 : grafana-9.2.10-4.el9
The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the grafana-9.2.10-4.el9 build changelog. - account takeover possible when using Azure AD OAuth CVE-2023-3128 Note that Nessus has not tested for this issue but has instead relied only on t...
CVE-2024-23493: Exposure of Sensitive Information to an Unauthorized Actor
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...
CentOS 9 : libldb-2.5.2-1.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libldb-2.5.2-1.el9 build changelog. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database...
How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin
Meet the guy who taught US intelligence agencies how to make the most of the ad tech ecosystem, "the largest information-gathering enterprise ever conceived by man."...
ad-zn.nl Improper Access Control vulnerability OBB-3859850
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
U.S. State Government Network Breached via Former Employee's Account
The U.S. Cybersecurity and Infrastructure Security Agency CISA has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee. "This allowed the threat actor to successfully authenticate to an internal...
Grafana Code Issue Vulnerability
Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. Grafana has a security vulnerability that stems from a CSV datasource plugin that...
CSAM Strengthens Attack Surface Coverage and Risk Assessment With Third-Party Connectors
Organizations using Qualys CyberSecurity Asset Management CSAM can now import asset data from any external system into the Enterprise TruRisk Platform. With third-party connectors, you will identify any existing coverage gaps and add business context to your unified inventory, helping you...
Progress WS_FTP Server < 8.7.6, 8.8.x < 8.8.4 Arbitrary File Upload
The remote host is running a version of WSFTP earlier than 8.7.6 or 8.8.x prior to 8.8.4. It is, therefore, affected by an arbitrary file upload vulnerability in the Ad Hoc Transfer Mode module. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload...
ad-kindai.co.jp Improper Access Control vulnerability OBB-3843400
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Zelle Is Using My Name and Voice without My Consent
Okay, so this is weird. Zelle has been using my name, and my voice, in audio podcast ads--without my permission. At least, I think it is without my permission. Its possible that I gave some sort of blanket permission when speaking at an event. Its not likely, but it is possible. I wrote to Zelle...
ad-hoc-news.de Cross Site Scripting vulnerability OBB-3836511
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
EulerOS Virtualization 2.11.1 : libldb (EulerOS-SA-2023-2727)
According to the versions of the libldb package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient an...
EulerOS Virtualization 2.11.0 : libldb (EulerOS-SA-2023-2758)
According to the versions of the libldb package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient an...
PT-2023-32934
Name of the Vulnerable Software and Affected Versions S-CMS versions 2.0 build20220529 through 2.0 build20231006 Description A critical issue has been found in S-CMS, affecting some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the arguments A text, A url, and A...
S-CMS SQL Injection Vulnerability
S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A SQL injection vulnerability exists in S-CMS version 2.0build20220529-20231006 and earlier versions, which originates from a problem with the unknown function of /member/ad.php?action=ad...
Happy 14th Birthday, KrebsOnSecurity!
KrebsOnSecurity celebrates its 14th year of existence today! I promised myself this post wouldnt devolve into yet another Cybersecurity Year in Review. Nor do I wish to hold forth about whatever cyber horrors may await us in 2024. But I do want to thank you all for your continued readership,...