SEC Charges 4 Companies Over Misleading SolarWinds Cyber Attack Disclosures

The U.S. Securities and Exchange Commission SEC has charged four current and former public companies for making "materially misleading disclosures" related to the large-scale cyber attack that stemmed from the hack of SolarWinds in 2020. The SEC said the companies – Avaya, Check Point, Mimecast,...

Exposed United Nations Database Left Sensitive Information Accessible Online

The 115,000-plus files related to UN Women included detailed financial disclosures from organizations around the world—and personal details and testimonials from vulnerable individuals...

Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.

Summary IBM Application Performance Management is vulnerable to denial of service, remote code execution, information disclosures and other vulnerabilities due to bundled product IBM ® Db2. This bulletin identifies the steps to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-318...

The US Government Is Asking Big Tech to Promise Better Cybersecurity

The Biden administration is asking tech companies to sign a pledge, obtained by WIRED, to improve their digital security, including reduced default password use and improved vulnerability disclosures...

PT-2024-22637

Name of the Vulnerable Software and Affected Versions: Xbox Gaming Services affected versions not specified Description: The issue concerns an elevation of privilege vulnerability in Xbox Gaming Services, allowing for the gain of SYSTEM privileges. There have been public disclosures and discussio...

Security Bulletin: There are multiple vulnerabilities in IBM Db2 bundled with IBM Operations Analytics Predictive Insights

Summary IBM Operations Analytics Predictive Insights is vulnerable to denial of service, remote code execution, information disclosures and other vulnerabilities due to bundled product IBM ® Db2. This bulletin identifies the steps to address the vulnerabilities. Vulnerability Details Refer to the...

CVE-2023-6112

creationtimestamp| type| source ---|---|--- 2024-01-29 11:38:00+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9870 2024-08-16 09:12:43+00:00| published-proof-of-concept| https://t.me/Rootsec2/2634 2024-08-16 09:12:55+00:00| published-proof-of-concept|...

GLSA-202401-23 : libuv: Buffer Overread

The remote host is affected by the vulnerability described in GLSA-202401-23 libuv: Buffer Overread - Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and increased without checking whether...

Peeking into the crystal ball: What 2023 cyber threats told us about 2024

By Raj Samani, SVP Chief Scientist, and Sabeen Malik, Vice President, Global Government Affairs and Public Policy at Rapid7 Stepping into 2024 feels like opening the latest best-selling mystery novel – you know there's adventure ahead, but the plot is still up in the air. In the twist-riddled wor...

The vulnerability of the Share Sheet component in operating systems such as iPadOS, tvOS, iOS, and watchOS allows attackers to disclose protected information.

The vulnerability of the Share Sheet component in iPadOS, tvOS, iOS, and watchOS is related to the lack of protection for service data. Exploiting this vulnerability can allow attackers to disclose sensitive information...

CVE-2023-4281

creationtimestamp| type| source ---|---|--- 2023-09-24 12:27:29+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5198 2023-09-24 13:31:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5199...

CVE-2023-4229

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized dat...

Security feature bypass

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized dat...

CVE-2023-4229 ioLogik 4000 Series: Session Headers Not Implemented

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized dat...

CVE-2023-4229 ioLogik 4000 Series: Session Headers Not Implemented

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized dat...

Daimler Truck: Server-based source code disclosures

URL: https://www.bharatbenz.com/TEST.PHP CWE: CWE-538 CVSS: 7.5-CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N One or more pages disclosing source code were found. This check is using pattern matching to determine if server side tags are found in the file. In some cases this alert may generate fals...

kiwitcms vulnerable to stored XSS via unrestricted files upload

Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded, see GHSA-fwcf-753v-fgcj and Content-Security-Policy definition to prevent...

Malicious code in mets-disclosures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c300cd1bdefb340a29adcef2aaf349875956aec72a7156652cf9dfed6bf26c79 The OpenSSF Package Analysis project identified 'mets-disclosures' @ 0.0.227 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1234 Malicious code in mets-disclosures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c300cd1bdefb340a29adcef2aaf349875956aec72a7156652cf9dfed6bf26c79 The OpenSSF Package Analysis project identified 'mets-disclosures' @ 0.0.227 npm as malicious. It is considered malicious because: - The package...

How to Reduce Exposure on the Manufacturing Attack Surface

Digitalization initiatives are connecting once-isolated Operational Technology OT environments with their Information Technology IT counterparts. This digital transformation of the factory floor has accelerated the connection of machinery to digital systems and data. Computer systems for managing...