9666 matches found
CVE-2023-37410: Undefined Security Weakness
IBM Personal Communications 14.05, 14.06, and 15.0.0 could allow a local user to escalate their privileges to the SYSTEM user due to overly permissive access controls. IBM X-Force ID: 260138...
IBM Personal Communications Security Breach
IBM Personal Communications is International Business Machines' IBM host communications and terminal emulation package for Microsoft Windows. It is now available in a complete 64-bit architecture with Virtual Terminal VT emulation and System Network Architecture SNA application support, and...
PT-2023-7765
Name of the Vulnerable Software and Affected Versions Nagios XI affected versions not specified Description The issue is related to the missingobjects.php script in Nagios XI, which has insufficient access controls. This can be exploited by a remote attacker to modify CCM settings and clear the...
Wallarm Webinar: NIST CSF 2.0, API Security, and CISO Imperatives
Last week, our good friend Raj Umadas, Director of Security at ActBlue, teamed up with our very own Tim Erlin, Head of Product, to talk about the newly proposed NIST Cybersecurity Framework CSF. It was a fantastic discussion covering the intent behind this update, the major changes from v1.1 to...
CLSA-2023-1695041084 Fix of 8 CVEs
CVE-url: https://ubuntu.com/security/CVE-2023-4622 - afunix: Fix null-ptr-deref in unixstreamsendpage. Jammy update: v5.15.105 upstream stable release LP: 2023230 // CVE-url: https://ubuntu.com/security/CVE-2022-4269 - net/sched: actmirred: better wording on protection against excessive stack...
FortiOS Graphical Interface XSS
The vulnerability of the graphical interface of FortiOS operating systems and the proxy server used for protecting against Internet attacks FortiProxy exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute...
Argo CD Authentication Bypass
The vulnerability of the application programming interface for the declarative delivery tool of GitOps for Kubernetes Argo CD is related to authentication errors. Exploiting this vulnerability allows a malicious actor to bypass established access controls...
GeoNode Code Issues Vulnerabilities
GeoNode is an open source platform that facilitates the creation, sharing and collaborative use of geospatial data. A code issue vulnerability exists in GeoNode that stems from the presence of a cross-site request forgery vulnerability that can bypass existing controls on the software...
How Cisco Talos IR helped a healthcare company quickly resolve a Qakbot attack
Partnership and proactive measures reduce resolution time from weeks to mere hours. Healthcare is one of the most popular targets for threat actors, as evidenced by the fact that it was the most-targeted sector in each of Cisco Talos Incident Responses past two Quarterly Trends Reports. But if...
PCI v4 is coming. Are you ready?
If you’ve landed here the chances are you are considering PCI compliance. At present the scheme is running against v3.2.1. In March 2022, the PCI Council released the long-anticipated v4.0. The Council stated that the changes represent their determination to “continue to meet the security needs o...
Siemens SIMATIC Products ANSI C OPC UA SDK Denial of Service Vulnerability
SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices with an OPC UA server interface to be connected as OPC UA clients.SIMATIC Drive Controllers are designed for the automation of production machines and combine the...
Unspecified Vulnerability in Siemens QMS Automotive
Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A security vulnerability exists in Siemens QMS Automotive version V12.39, which stems from a lack of security controls in the affected application to prevent unencrypted communication without...
PT-2023-5026 · Microsoft · Azure Hdinsight
Name of the Vulnerable Software and Affected Versions: Azure HDInsight affected versions not specified Description: The issue is related to insufficient access controls in Azure HDInsight, allowing a remote attacker to elevate their privileges using a specially crafted request. Recommendations: A...
PT-2023-5067 · Microsoft · Azure Kubernetes Service
Name of the Vulnerable Software and Affected Versions: Microsoft Azure Kubernetes Service affected versions not specified Description: The issue is related to insufficient access controls in the Microsoft Azure Kubernetes Service, which can be exploited by a remote attacker to elevate their...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability caused by a logic error in the code in loadMediaResumptionControls of MediaResumeListener.kt. An attacker can exploit this vulnerability to obtain sensitiv...
Apache Hadoop Distributed Development File Permissions
The vulnerability of the Apache Hadoop distributed development and execution platform is related to the improper assignment of permissions for files. Exploiting this vulnerability allows a malicious actor to circumvent restrictions on file access remotely...
CVE-2023-38486
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary...
CVE-2023-38486 Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary...
kube-apiserver: PrivEsc
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...