UBUNTU-CVE-2023-5421

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was...

OTRS Cross-Site Scripting Vulnerability

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS versions prior to 7.0.47, 8.0.37, and OTRS Community Edition versions 6.0.X through 6.0.34, which originates from the fact that an attacker with the privilege to create and change...

Motel One Group’s Swift Response Thwarts Ransomware Attack

By Waqas Europe's Leading Hotel Operator Takes Immediate Action to Protect Customer Data. This is a post from HackRead.com Read the original post: Motel One Groups Swift Response Thwarts Ransomware Attack...

CVE-2023-4145

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

CVE-2023-4145 Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

CVE-2023-4145 Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

CVE-2023-4145

CVE-2023-4145 is a stored XSS vulnerability in pimcore/customer-data-framework present in versions prior to 3.4.2. The issue stems from cross-site scripting in the Customer Data Framework that could be triggered via HTML injection in emails, potentially allowing an attacker to influence a victim’...

Pimcore customer-data-framework Cross-Site Scripting Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...

PT-2023-27953 · Pimcore · Pimcore/Customer-Data-Framework

Name of the Vulnerable Software and Affected Versions: pimcore/customer-data-framework versions prior to 3.4.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which can be exploited by an attacker to trick victims into clicking on malicious hyperlinks, potentially leading ...

Rudder Server SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rudder Server SQLI Remote Code Execution', 'Description' = %q This Metasploit module exploits a SQL injection vulnerability in RudderStack's...

Cloudflare Public Bug Bounty: Permanent CASB Integration Takeover due to Improper Access Controls+Confused Deputy Problem

A security vulnerability was discovered in Cloudflare's Cloud Access Security Broker CASB integration, allowing potential unauthorized access to sensitive information. The vulnerability, known as the "confused deputy problem," affected a limited set of integrations. Cloudflare promptly addressed...

Security Bulletin: Watson Query potentially exposes adminstrator's key under some conditions due to CVE-2022-22410

Summary Watson Query is vulnerable to an internal attacker who can use an exposed administrator APIKEY to potentially alter system configuration or view customer data. The APIKEY is used to automatically create connections and assets to help reduce workload for the user. However, in some...

The Japanese Technology and Media Attack Landscape

Recently, we released a major report analyzing the threat landscape of Japan, the globe’s third largest economy. In that report we looked at the ways in which threat actors infiltrate Japanese companies spoiler alert: it is often through foreign subsidiaries and affiliates and some of the most...

VirusTotal Data Leak Exposes Some Registered Customers' Details

Data associated with a subset of registered customers of VirusTotal, including their names and email addresses, were exposed after an employee inadvertently uploaded the information to the malware scanning platform. The security incident, which comprises a database of 5,600 names in a 313KB file,...

CVE-2023-3574

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574 Improper Authorization in pimcore/customer-data-framework

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574 Improper Authorization in pimcore/customer-data-framework

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574 Improper Authorization in pimcore/customer-data-framework

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574

CVE-2023-3574 : The issue affects pimcore/customer-data-framework prior to 3.4.1, where improper authorization checks allow an unauthorized actor to access resources or perform actions. The Red Hat/Veracode/GHSA entries corroborate the same vulnerability description. A patch is available: upgrade...