CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...

CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...

PT-2025-3072 · Spagobi · Spagobi

Name of the Vulnerable Software and Affected Versions: SpagoBI version 3.5.1 Description: A Cross-Site Request Forgery CSRF issue has been found in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in,...

CVE-2024-54792

CVE-2024-54792 : SpagoBI 3.5.1 is affected by a CSRF vulnerability in the user administration panel. An authenticated attacker can induce a logged-in admin to perform unwanted actions (e.g., add/edit/delete users) on behalf of the victim via crafted requests. The issue is demonstrated in multiple...

CVE-2024-54792

A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...

Biden's Cyber Ambassador Urges Trump Not to Cede Ground to Russia and China in Global Tech Fight

Nathaniel Fick, the ambassador for cyberspace and digital policy, has led US tech diplomacy amid a rising tide of pressure from authoritarian regimes. Will the Trump administration undo that work?...

CVE-2024-21797

A command execution vulnerability exists in the adm.cgi setTR069 functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CISA: Transportation Security Administration Surface Operations Overview

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CVE-2024-45100

CVE-2024-45100 affects IBM Security QRadar EDR (ReaQta) 3.12. The vulnerability arises from improper allocation of resources, enabling a privileged user to cause a denial of service by sending multiple administration requests. IBM’s security bulletin documents this CVE alongside CVE-2024-45640 an...

PT-2024-17874 · Unknown · Phpgurukul Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Maid Hiring Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file /admin/edit-category.php. The manipulation of the editid argument leads to SQL injection. I...

CVE-2024-54775

Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting XSS vulnerability via /admin/auth/menu and /admin/auth/extensions...

PT-2024-17839 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 1.0 Description: A critical issue has been found in the PHPGurukul Complaint Management System. This issue affects an unknown part of the /admin/state.php file. The manipulation of the state...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. 1000 Projects Attendance Tracking Management System version 1.0 suffers from an injection vulnerability, which originates from the parameter facultycourseid in the file...

Absolute Secure Access 跨站脚本漏洞

Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A cross-site scripting vulnerability exists in versions prior to Absolute Secure Access 13.52. An attacker exploiting this vulnerability could interfere...

Congress Again Fails to Limit Scope of Spy Powers in New Defense Bill

The National Defense Authorization Act passed today, but lawmakers stripped language that would keep the Trump administration from wielding unprecedented authority to surveil Americans...

The Top Cybersecurity Agency in the US Is Bracing for Donald Trump

Staffers at the Cybersecurity and Infrastructure Security Agency tell WIRED they fear the new administration will cut programs that keep the US safe—and “persecution.”...

GO-2024-3325 kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp...

Description of the security update for SharePoint Server 2019 Language Pack: December 10, 2024 (KB5002664)

None None...

FTC Says Data Brokers Unlawfully Tracked Protesters and US Military Personnel

The FTC is targeting data brokers that monitored people’s movements during protests and around US military installations. But signs suggest the Trump administration will be far more lenient...