A week in security (September 5 – 11)

Last week on Malwarebytes Labs: Phishers use verified status as bait for Instagram users Microsoft will disable Basic authentication for Exchange Online in less than a month Zero-day puts a dent in Chrome's mojo Update now! QNAP warns users DeadBolt is exploiting Photo Station vulnerability Don't...

antiquespisos.com Cross Site Scripting vulnerability OBB-2909804

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vulnerability fixed in HP Support Assistant

HP has fixed a vulnerability in the Support Assistant, software installed by default on desktops and notebooks from HP. The vulnerability allows a local malicious party to increase its permissions. HP has released version 9.11 as an update to fix the problem. fix. For more information, see:...

The vulnerability of the performance optimization tool of the HP Performance Tune-up software, a software solution for automated support and driver updates by HP Support Assistant, allows a hacker to execute arbitrary code.

The vulnerability of the HP Performance Tune-up performance optimization tool, a software solution for automated support and driver updates by HP Support Assistant, lies in the possibility of replacing the dynamic library. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Your HP Support Assistant needs an update!

HP has issued a new version of its HP Support Assistant tool. Users of HP Support Assistant versions earlier than 9.11 and Fusion versions earlier than 1.38.2601.0 are affected by a high severity vulnerability. According to HP it is possible for an attacker to exploit a dynamic-link library DLL...

Privilege escalation in HP Support Assistant

HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up. HP strives to...

PT-2022-4714 · Hewlett Packard · Hp Support Assistant +1

Name of the Vulnerable Software and Affected Versions: HP Support Assistant version 9 Description: The issue is related to a DLL hijacking vulnerability in HP Support Assistant, which uses HP Performance Tune-up as a diagnostic tool. This vulnerability can be exploited by an attacker to elevate...

forms.camden.gov.uk Cross Site Scripting vulnerability OBB-2880927

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Netty information disclosure (CVE-2022-24823)

Summary Potential vulnerabilities in Netty - CVE-2022-24823 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-24823 DESCRIPTION: Netty could allow a local authenticated attacker to...

noiyiniton.top Cross Site Scripting vulnerability OBB-2859614

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jeremyreiss.fr Cross Site Scripting vulnerability OBB-2856889

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

chronoprod.fr Cross Site Scripting vulnerability OBB-2848015

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

aalborgstift.dk Cross Site Scripting vulnerability OBB-2841857

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

alexisprost.fr Cross Site Scripting vulnerability OBB-2837222

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Intel® DSA Advisory

Summary: A potential security vulnerability in the Intel® Driver & Support Assistant DSA software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-26017 Description: Improper access control in t...

tunnetaitojalapselle.fi Cross Site Scripting vulnerability OBB-2830644

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

adicciones.barcelona Cross Site Scripting vulnerability OBB-2827172

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

What’s New in InsightVM and Nexpose: Q2 2022 in Review

The Vulnerability Management team kicked off Q2 by remediating the instances of Spring4Shell CVE-2022-22965 and Spring Cloud CVE-2022-22963 vulnerabilities that impacted cybersecurity teams worldwide. We also made several investments to both InsightVM and Nexpose throughout the second quarter tha...

IBM Engineering Requirements Quality Assistant跨站请求伪造漏洞

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM to assist developers in improving the quality of engineering requirements. The application can significantly reduce the cost of finding defects, facilitate the early detection of requirements errors in the...

IBM Engineering Requirements Quality Assistant Cross-Site Scripting Vulnerability (CNVD-2022-87649)

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM to assist developers in improving the quality of engineering requirements. All versions of IBM Engineering Requirements Quality Assistant are vulnerable to a cross-site scripting vulnerability that stems from a...