PT-2024-13188 · Liferay · Liferay Dxp

Name of the Vulnerable Software and Affected Versions: Liferay DXP versions 7.4 GA through update 92 Liferay DXP 2023.Q3 before patch 6 Description: The issue allows remote attackers to redirect users to arbitrary external URLs via the com liferay adaptive media web portlet AMPortlet redirect...

The vulnerability of the /admin/info/properties component of the Apache Solr search server, which allows a hacker to disclose protected information

The vulnerability of the /admin/info/properties component of the Apache Solr search server is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

CVE-2023-47218: QNAP QTS and QuTS Hero Unauthenticated Command Injection (FIXED)

Rapid7 has identified an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry- and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numero...

The vulnerability of the system administration program Sudo, related to deficiencies in the authentication process, allows attackers to escalate their privileges.

The vulnerability of the system administration program Sudo is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to increase their privileges...

QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numerous QNAP...

PT-2024-2061 · Pixelfed · Pixelfed

Name of the Vulnerable Software and Affected Versions: Pixelfed versions 0.10.4 through 0.11.9 Description: The issue arises from improper and insufficient authorization checks when processing requests, allowing attackers to access more functionality than intended, including administrative and...

How 3 Million ‘Hacked’ Toothbrushes Became a Cyber Urban Legend

Plus: China’s Volt Typhoon hackers lurked in US systems for years, the Biden administration’s crackdown on spyware vendors ramps up, and a new pro-Beijing disinformation campaign gets exposed...

CVE-2023-40262

An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site Scripting XSS in the administration component via Access Request...

kernel: refcount leak in ctnetlink_create_conntrack()

A memory leak problem was found in ctnetlinkcreateconntrack in net/netfilter/nfconntracknetlink.c in the Linux Kernel. This issue may allow a local attacker with CAPNETADMIN privileges to cause a denial of service DoS attack due to a refcount overflow...

CVE-2024-22388

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

Design/Logic Flaw

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2024-22388 Insecure Default Initialization of Resource in HID Global

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2024-22388

CVE-2024-22388 affects HID Global devices configured as encoders (e.g., iCLASS SE CP1000 Encoder, iCLASS SE Readers/Modules/Processors, OMNIKEY 5427CK/5127CK/5023/5027). Root cause: improper authorization in the encoder communication channel enables exposure of sensitive data when reader configur...

CVE-2024-22388 Insecure Default Initialization of Resource in HID Global

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2024-1259

A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the argument apppicurl leads to unrestricted upload. The...

mailcow resource management error vulnerability

mailcow is a mail server suite. A resource management error vulnerability exists in mailcow that stems from the application slowing down and becoming unresponsive in the administration page once the payload is successfully uploaded in the logo. No details of the vulnerability are provided at this...

PT-2024-20695 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: XenForo versions prior to 2.2.14 Description: The issue allows Directory Traversal with write access by an authenticated user who has permissions to administer styles. This is possible when using a ZIP archive for Styles Import...

BIT-LIFERAY-2023-33946

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope...

Malicious Google Ads Target Chinese Users, Covertly Delivering RATs

Summary: Chinese-speaking users are being targeted in an ongoing malvertising campaign that leverages Google ads. The threat actor employs Google advertiser accounts to create deceptive ads that lure users into downloading Remote Administration Trojans RATs. The malicious ads are designed to mimi...

CVE-2023-6633

The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks...