Justice Department Indicts Tech CEO for Falsifying Security Certifications

The Wall Street Journal is reporting that the CEO of a still unnamed company has been indicted for creating a fake auditing company to falsify security certifications in order to win government business...

Microsoft SQL Server Masked Data Exposure

Title: SQL Server Masked Data Exposure Through Brute Force Attack Product: Database Manufacturer: Microsoft Affected Versions: SQL Server 2014, 2016,2017,2019,2022 Tested Versions: SQL Server 2014, 2016,2017,2019,2022 Risk Level: Low Security Feature: Dynamic Data Masking Author of Advisory: Emad...

ManageEngine ADAudit Plus < Build 8110 Multiple Vulnerabilities

The version of ManageEngine ADAudit Plus installed on the remote host is prior to build 8110. It is, therefore, affected by multiple vulnerabilities. - Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option...

CVE-2024-5527

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration...

CVE-2024-5527

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration...

CVE-2024-5527 SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration...

CVE-2024-5527 SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration...

CVE-2024-5527

CVE-2024-5527 affects Zohocorp ManageEngine ADAudit Plus versions below 8110. The vulnerability is an authenticated SQL Injection in the file auditing configuration, caused by unsafe handling of input in that configuration. Impact is described as high for confidentiality, integrity, and availabil...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37147

GLPI (open-source IT asset/ITIL Service Desk) has a vulnerability (CVE-2024-37147) where an authenticated user can attach a document to any item even without write access. Connected PTSecurity entries describe affected versions as prior to 10.0.16 and indicate the issue stems from improper access...

GO-2024-2591 Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server

Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Ruijie Networks RG-UAC Command Injection Vulnerability

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. A command injection vulnerability exists in Ruijie Networks RG-UAC version 1.0, which stems from the fact that incorrect...

SQL Injection Vulnerability in Renzihang Network Security Audit System of Renzihang Network Technology Co. Ltd (CNVD-2024-29960)

Renzi Network Technology Co., Ltd. is a provider of network auditing and regulatory solutions. A SQL injection vulnerability exists in the Renzihang Network Security Audit System of Renzihang Network Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

CVE-2024-24919 Exploit tool to validate CVE-2024-24919 vulnera...

Zoho ManageEngine ADAudit Plus 安全漏洞

ZOHO ManageEngine ADAudit Plus is used by Zoho USA, Inc. to simplify auditing, demonstrate compliance and detect threats. A security vulnerability exists in Zoho ManageEngine ADAudit Plus prior to version 7271, which stems from a SQL injection issue in the Lock History option...

[SECURITY] Fedora 38 Update: sssd-2.9.4-2.fc38

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

[SECURITY] Fedora 39 Update: sssd-2.9.4-2.fc39

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

PT-2024-20717 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 IBM Cognos Analytics versions 12.0.0 through 12.0.2 Description: The issue is related to injection attacks in application logging due to the lack of sanitization of user-provided data. This...

PT-2024-18402 · WordPress · The Event Monster

Name of the Vulnerable Software and Affected Versions: The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress versions up to, and including, 1.3.4 Description: The issue concerns a PHP Object Injection vulnerability via deserialization of untrusted input from a...

HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault Enterprise is an enterprise information archiving platform from HashiCorp USA. Captures information across all communication platforms - seamlessly migrating information from local to the cloud and automatically identifying the most relevant content to ensure regulatory compliance...