17062 matches found
PT-2024-7806 · Autodesk · Autodesk Navisworks
Name of the Vulnerable Software and Affected Versions: Autodesk Navisworks affected versions not specified Description: A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force an Out-of-Bounds Read. This can allow a malicious actor to cause a crash, read...
Malicious code in @ampol/design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7583d639bf7d61499f7cac9da21bc3a507a7af5a21d6ee198303de1e0383f009 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Royal Ransomware Actors Rebrand as “BlackSuit,” FBI and CISA Release Update to Advisory
Today, CISA—in partnership with the Federal Bureau of Investigation FBI—released an update to joint Cybersecurity Advisory StopRansomware: Royal Ransomware, StopRansomware: BlackSuit Royal Ransomware. The updated advisory provides network defenders with recent and historically observed tactics,...
Researchers Uncover Flaws in Windows Smart App Control and SmartScreen
Cybersecurity researchers have uncovered design weaknesses in Microsoft's Windows Smart App Control and SmartScreen that could enable threat actors to gain initial access to target environments without raising any warnings. Smart App Control SAC is a cloud-powered security feature introduced by...
Cross-site Scripting (XSS)
Magento-lts is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper system config sanitisation within the design/header/welcome, design/header/logosrc, design/header/logosrcsmall, and design/header/logoalt, which allows an admin authenticated attacker to perform Cross-site...
This Week in Spring - July 29th, 2024
Hi Spring fans! Welcome to another installment of This Week in Spring! It's July 29th, 2024! I can hardly believe it! We're less than a month away from SpringOne 2024! Have you registered for either in-person attendance or the free livestreams yet? As always, we've got a ton of stuff to cover so...
GHSA-5VRP-638W-P8M2 Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Impact This XSS vulnerability is about the system configs design/header/welcome design/header/logosrc design/header/logosrcsmall design/header/logoalt They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously...
CVE-2024-41676
Magento LTS (OpenMage Magento-lts) is affected by an XSS in system config fields design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt due to missing escaping. The issue allows input of arbitrary HTML/JavaScript and is mitigated by upgrading to ve...
PT-2024-29501 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento-lts versions prior to 20.10.1 Description: This issue affects the design/header/welcome, design/header/logo src, design/header/logo src small, and design/header/logo alt system configs, which are intended to enable admins to set a tex...
Researchers Claim Anyone Can Access Deleted, Private GitHub Repository Data
Cybersecurity researchers have revealed a GitHub design flaw that allows access to deleted and private repository data. Learn…...
WordPress Hide My WP Ghost Plugin < 5.2.02 is vulnerable to Bypass Vulnerability
Software Hide My WP Ghost Type Plugin Vulnerable versions 5.2.02 Fixed in 5.2.02 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-6420 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID c358fc787ef1 Credits Juan Pablo Gomez Postigo Required...
[SECURITY] Fedora 39 Update: python-django4.2-4.2.14-1.fc39
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
[SECURITY] Fedora 39 Update: python-django-4.2.14-2.fc39
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
[SECURITY] Fedora 40 Update: python-django-4.2.14-2.fc40
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
CISA and FBI Release Secure by Design Alert on Eliminating OS Command Injection Vulnerabilities
Today, CISA and FBI are releasing their newest Secure by Design Alert in the series, Eliminating OS Command Injection Vulnerabilities, in response to recent well-publicized threat actor campaigns that exploited OS command injection defects in network edge devices CVE-2024-20399link is external,...
app.valuationcontrol:webservice (>=0.5.0 <=0.5.1), ba.sake:sharaf_3 (>=0.0.7 <=0.7.4) +974 more potentially affected by CVE-2024-3653 via io.undertow:undertow-core (>=2.3.0.Alpha1 <=2.3.14.Final)
io.undertow:undertow-core MAVEN version =2.3.0.Alpha1, =0.5.0, =0.0.7, =1.1.15, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.31 and more Source cves: CVE-2024-3653 Source advisory: OSV:GHSA-CH7Q-GPFF-H9HP...
CISA and Partners join ASD’S ACSC to Release Advisory on PRC State-Sponsored Group, APT 40
CISA has collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre ASD's ACSC to release an advisory, People’s Republic of China PRC Ministry of State Security APT40 Tradecraft in Action outlining a PRC state-sponsored cyber group’s activity. The following...
Malicious code in MaterialDesignExtensions.Net (NuGet)
--- -= Per source details. Do not edit below this line.=-...