A week in security (April 1 – April 7)

A list of topics we covered in the week of April 1 to April 7 of 2024 Last week on Malwarebytes Labs: 60% of small businesses are concerned about cybersecurity threats Cookie consent choices are just being ignored by some websites Bing ad for NordVPN leads to SecTopRAT Jackson County hit by...

CandyCMS 安全漏洞

CandyCMS is a simple PHP CMS open-sourced by Stephen Radford. A security vulnerability exists in CandyCMS version 1.0.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the install.php component...

Apfloat 安全漏洞

Apfloat is a high-performance arbitrary-precision arithmetic library from the individual developer Mikko Tommila. A security vulnerability exists in Apfloat version v1.10.1, which stems from a null pointer exception contained in the component org.apfloat.internal.DoubleCRTMath adddouble, double...

Saleor 安全漏洞

Github saleor is a headless GraphQL commerce platform that delivers a super-fast, dynamic, personalized shopping experience. Beautiful online store, anywhere, on any device. Saleor has a security vulnerability that stems from allowing to bypass cross-site request forgery checks...

PT-2024-3188

Name of the Vulnerable Software and Affected Versions Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 Description A firmware issue in the control plane fails to properly sanitize data, allowing an unauthenticated remote attacker to execute arbitrary system commands. This is achieved by exploiting...

UP-RESULT 0.1 2024 SQL Injection

Title: upresult0.1-2024 Multiple-SQLi Author: nu11secur1ty Date: 04/08/2024 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download Reference:...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.22 (SUSE-SU-2024:1121-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1121-1 advisory. - CVE-2023-45288: Fixed denial of service via HTTP/2 continuation frames bsc1221400 Tenable has extracted...

Unify CP IP Phone 安全漏洞

Unify CP IP Phone is a phone from Unify Germany. A security vulnerability exists in Unify CP IP Phone version 1.10.4.3, which stems from the use of weak credentials...

Hacker Leaks 8.5M U.S. Environmental Protection Agency (EPA) Contact Data (UPDATED)

By Waqas CISA Cybersecurity and Infrastructure Security Agency informed Hackread.com that the data was already publicly available. This is a post from HackRead.com Read the original post: Hacker Leaks 8.5M U.S. Environmental Protection Agency EPA Contact Data UPDATED...

57,000 Kaspersky Fan Club Forum User Data Leaked in Hosting Breach

By Waqas Hacker group RGB claims responsibility for breaching Kaspersky's fan club and the Prosecutor's Office of the Russian Federation, leaking over 100,000 criminal records. This is a post from HackRead.com Read the original post: 57,000 Kaspersky Fan Club Forum User Data Leaked in Hosting Bre...

Alleged Home Depot Data Breach: IntelBroker Leaks 22,000 Employee Data

By Waqas Another day, another data breach by IntelBroker hacker targeting a US-based giant! This is a post from HackRead.com Read the original post: Alleged Home Depot Data Breach: IntelBroker Leaks 22,000 Employee Data...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google Inc USA. A security vulnerability exists in Google Pixel, which stems from a missing bounds check in the tmugettrthresholds module, which may result in out-of-bounds reads...

CData Arc 安全漏洞

CData Arc is a new data connectivity platform from CData Corporation designed to help organizations enable data-driven decision making and innovation. A security vulnerability exists in CData Arc versions prior to 23.4.8839 that stems from the presence of a path traversal vulnerability. An attack...

Lenovo ThinkStation 安全漏洞

Lenovo Desktops and Lenovo ThinkStation are both products of the Chinese company Lenovo.Lenovo Desktops are desktop computers.Lenovo ThinkStation are desktop workstations. A security vulnerability exists in the BIOS of Lenovo Desktop, Smart Edge, Smart Office, and ThinkStation, which stems from a...

Aplaya Beach Resort Online Reservation System 安全漏洞

Aplaya Beach Resort Online Reservation System is the online room reservation system for Aplaya Beach Resort. A security vulnerability exists in SourceCodester Aplaya Beach Resort Online Reservation System version 1.0, which originates from an SQL injection in the id parameter of the...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that stems from the presence of a logic error that has a possible way to bypass...

MAL-2024-1201 Malicious code in lodash-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a8bd312773fbb24be9c3b0b0f20151edfa60314696b7db82861805252d9fc24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

InstantCMS 安全漏洞

InstantCMS is a free open source CMS from instantSoft open source. A security vulnerability exists in InstantCMS version v2.16.2, which stems from a SQL injection vulnerability in indexchartdata...

ITB-GmbH TradePro 安全漏洞

ITB-GmbH TradePro is a complete B2B e-shop from ITB-GmbH. A security vulnerability exists in ITB-GmbH TradePro version v9.5, which stems from incorrect access control. A remote attacker uses the vulnerability to receive all order confirmations from the online store via the printmail plugin...

U.S. Cyber Safety Board Slams Microsoft Over Breach by China-Based Hackers

The U.S. Cyber Safety Review Board CSRB has criticized Microsoft for a series of security lapses that led to the breach of nearly two dozen companies across Europe and the U.S. by a China-based nation-state group called Storm-0558 last year. The findings, released by the Department of Homeland...