3494 matches found
SoftGuard SNMP Network Management Extension HTML Injection / File Download Vulnerability
======================================================================= title: Multiple vulnerabilities product: SoftGuard SNMP Network Management Extension vulnerable version: SoftGuard Web SGW 5.1.5 fixed version: SoftGuard version 5.1.5 from 2022-06-01 CVE number: CVE-2022-31201, CVE-2022-3120...
MAL-2022-1136 Malicious code in assessment-zmarta (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45653801bc7c04da5271fafa815874ed3e90695328e763a6415f729f6de09968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in assessment-zmarta (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45653801bc7c04da5271fafa815874ed3e90695328e763a6415f729f6de09968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
A week in security (June 13 – June 19)
Last week on Malwarebytes Labs: Serious vulnerabilities found in ITarian software, patches available for SaaS products Update Chrome now: Four high risk vulnerabilities found Taking down the IP2Scam tech support campaign Don’t panic! “Unpatchable” Mac vulnerability discovered Introducing...
kischuni.de Cross Site Scripting vulnerability OBB-2656092
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Upgraded Q -> M from 36 [1655654413719]
Judge has assessed an item in Issue 36 as Medium risk. The relevant finding follows: Allows owner to mint more tokens than planned There are two ways for the owner of the contract to mint tokens for themselves unrelated to the public sale: through the teamSummon function or by setting the minter ...
vulhub
This is an open-source vulnerability training platform. It is a collection of vulnerable environments for training and testing purposes, allowing users to practice their penetration testing and vulnerability assessment skills in a safe and controlled environment. The platform is maintained by the...
Introducing Malwarebytes Vulnerability Assessment for OneView: How to check for Common Vulnerabilities and Exposures (CVEs)
Malwarebytes is happy to announce our Vulnerability Assessment module for OneView, our multi-tenant console where you can manage Malwarebytes Nebula accounts, subscriptions, invoicing, and integrations. This module enables our MSPs to scan, identify, and assess vulnerabilities in customers’ digit...
Siemens Teamcenter Active Workspace
1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Active Workspace Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for malicious code execution. 3...
5 ways to connect with Microsoft Security at Identiverse 2022
Identiverse is where the industry gathers to discuss all things identity. The 2022 conference will take place June 21 to 24 in Denver, Colorado, and I’m absolutely thrilled that Microsoft will be there. At Identiverse, we’ll share how we help customers secure access in a hybrid, multicloud, and...
5 ways to connect with Microsoft Security at Identiverse 2022
Identiverse is where the industry gathers to discuss all things identity. The 2022 conference will take place June 21 to 24 in Denver, Colorado, and I’m absolutely thrilled that Microsoft will be there. At Identiverse, we’ll share how we help customers secure access in a hybrid, multicloud, and...
Critical: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.3 security update
Red Hat OpenShift Service Mesh 2.1.3 has been released. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...
Upgraded Q -> M from 96 [1655008585673]
Judge has assessed an item in Issue 96 as Medium risk. The relevant finding follows: Impact - LOW PrePo protocol do not appear to support rebasing/deflationary/inflationary tokens whose balance changes during transfers or over time. The necessary checks include at least verifying the amount of...
Upgraded Q -> H from 25 [1655007954017]
Judge has assessed an item in Issue 25 as High risk. The relevant finding follows: Fees should have a boundary of 100% 10000: Otherwise the contract will try to transfer more than possible which will result in reverts: It might also be helpful the have an fixed upper boundary that doesn't allow t...
LinkedIn: IDOR - Delete technical skill assessment result & Gained Badges result of any user
The web app is vulnerable to IDOR at DELETE /voyager/api/voyagerAssessmentsDashSkillAssessmentAttemptReports/urn%3Ali%3AfsdskillAssessmentAttemptReport%3Aurn%3Ali%3Afsdprofile%███%2Curn%3Ali%3Askill%3A280%2C1 HTTP request. Allows an attacker to delete the skill assessment result of any user's...
Evaluating the Security of an Enterprise IoT Deployment at Domino's Pizza
Recently, I had a great opportunity to work with Domino's Pizza to evaluate an internally conceived Internet of Things IoT-based business solution they had designed and deployed throughout their US store locations. The goal of this research project was to understand the security implications arou...
Upgraded Q -> M from 103 [1654497041670]
Judge has assessed an item in Issue 103 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 268 [1654474507101]
Judge has assessed an item in Issue 268 as Medium risk. The relevant finding follows: High feeRate can break core protocol function PROBLEM There is no maximum input value on setFee in Cally.sol. But if the owner sets it to a uint greater than 1e18, the users will not be able to call exercice as...
Upgraded Q -> M from 190 [1654475279061]
Judge has assessed an item in Issue 190 as Medium risk. The relevant finding follows: L-02 Fee in Cally.setFee should be upper-bounded A malicious owner or owner account compromise can set the fee very high, up to 100%, siphoning all profits from the protocol. Consider implementing a reasonable...