SLiMS 9 Bulian SQL Injection Vulnerability

SLiMS 9 Bulian is a free and open source software from the SLiMS community in Indonesia. It is used for library resource management e.g. books, journals, digital files and other library materials and administration. An SQL injection vulnerability exists in SLiMS 9 Bulian version v9.6.1, which...

PT-2023-32512 · Unknown · Ics Business Manager

Name of the Vulnerable Software and Affected Versions: ICS Business Manager version 7.06.0028.7066 Description: A security issue has been identified, allowing a remote attacker to send a specially crafted string, exploiting the obdd act parameter. This could enable the attacker to steal an...

Government Surveillance Reform Act of 2023 Seeks to End Warrantless Police and FBI Spying

The Government Surveillance Reform Act of 2023 pulls from past privacy bills to overhaul how police and the feds access Americans’ data and communications...

SolarWinds and its CISO accused of misleading investors before major cyberattack

The Securities and Exchange Commission SEC has announced charges against software company SolarWinds Corporation and its chief information security officer CISO, Timothy G. Brown, for “fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities.” In 202...

Breaking down barriers: Redefining the FedRAMP® journey for cloud service providers

Since the passing of the FedRAMP Authorization Act last December, inquiries about navigating FedRAMP's complex landscape have surged. Recognizing this, Coalfire is pioneering a new pathway to streamline the FedRAMP authorization process, making it more accessible for cloud service providers...

CLSA-2023-1695041288 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-4622 - afunix: Fix null-ptr-deref in unixstreamsendpage. Jammy update: v5.15.105 upstream stable release LP: 2023230 // CVE-url: https://ubuntu.com/security/CVE-2022-4269 - net/sched: actmirred: better wording on protection against excessive stack...

CVE-2023-35666

In btaavrcmsg of btaavact.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Deciso OPNsense Cross-Site Scripting Vulnerability

Deciso OPNsense is a FreeBSD-based open source firewall and routing software from the Dutch company Deciso. A cross-site scripting vulnerability exists in OPNsense versions prior to 23.7, which stems from a cross-site scripting XSS vulnerability in the act parameter of the systemcertmanager.php...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

The end looms for Meta's behavioural advertising in Europe

The EU is going toe to toe with Meta once more, with the social network giant conceding defeat yet again. After having taken Meta to task for various privacy violations and data breaches, Meta is now having to provide European users with a way to opt out of behavioural advertising. The threat of...

Fuge CMS 输入验证错误漏洞

Fuge CMS is a CMS project by Fuge Individual Developers. A security vulnerability exists in Fuge CMS version 1.0, which stems from an open redirection vulnerability in /front/ProcessAct.java...

Fuge CMS 输入验证错误漏洞

Fuge CMS is a CMS project by Fuge Individual Developers. A security vulnerability exists in Fuge CMS version 1.0, which stems from an open redirection vulnerability in member/RegisterAct.java...

Apple Threatens to Pull iMessage and FaceTime from U.K. Amid Surveillance Demands

Apple has warned that it would rather stop offering iMessage and FaceTime services in the U.K. than bowing down to government pressure in response to new proposals that seek to expand digital surveillance powers available to state intelligence agencies. The development, first reported by BBC News...

FortiGuard Labs Discovers .ZIP Domains Fueling Phishing Attacks

By Waqas According to Fortinet Labs, third parties have already purchased top-level domains TLD such as Joomla.zip and MSNBC.zip, which could potentially be a breach of the Anticybersquatting Consumer Protection Act ACPA. This is a post from HackRead.com Read the original post: FortiGuard Labs...

Proposed Massachusetts law to ban sale of your mobile location data

Cellular location phone data may be banned from sale in the state of Massachusetts, under a proposed law set to ruffle some data broker feathers. The selling of location data has long been a point of contention for privacy experts. As with so much bulk user data, claims of anonymity from the...

US Spies Are Buying Americans' Private Data. Congress Has a Chance to Stop It

The National Defense Authorization Act may include new language forbidding government entities from buying Americans' search histories, location data, and more...

From MuddyC3 to PhonyC2: Iran's MuddyWater Evolves with a New Cyber Weapon

The Iranian state-sponsored group dubbed MuddyWater has been attributed to a previously unseen command-and-control C2 framework called PhonyC2 that's been put to use by the actor since 2021. Evidence shows that the custom made, actively developed framework has been leveraged in the February 2023...