CVE-2024-21780: Out-of-bounds Write

Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a denial of service DoS condition. Note that the affected products are no longer supported...

PT-2024-20215 · Unknown · Home Spot Cube2

Name of the Vulnerable Software and Affected Versions: HOME SPOT CUBE2 versions V102 and earlier Description: A heap-based buffer overflow issue exists, allowing arbitrary code execution by processing invalid values. The affected products are no longer supported. Recommendations: For HOME SPOT...

PT-2024-19053 · Unknown · Home Spot Cube2

Name of the Vulnerable Software and Affected Versions: HOME SPOT CUBE2 versions V102 and earlier Description: A stack-based buffer overflow vulnerability exists, which may result in a denial of service DoS condition when processing a specially crafted command. The affected products are no longer...

A week in security (January 22 – January 28)

Last week on Malwarebytes Labs: 10 things to do to improve your online privacy Ring curtails law enforcement’s access to footage Malicious ads for restricted messaging applications target Chinese users Malwarebytes wins every MRG Effitas award for 2 years in a row AI likely to boost ransomware,...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input test leads to cross site scripting. The attack may be...

CVE-2024-0948 NetBox Home Page Configuration config-revisions cross site scripting

DISPUTED A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input test leads to cross site scripting. The atta...

CVE-2024-0948

NetBox is affected up to version 3.7.0 by a vulnerability in the /core/config-revisions handler that can lead to cross-site scripting when processing input such as test. Descriptions consistently indicate the issue is a XSS flaw resulting from unknown processing in the Home Page Configuration com...

CVE-2024-0948 NetBox Home Page Configuration config-revisions cross site scripting

DISPUTED A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input test leads to cross site scripting. The atta...

home-works.jp Improper Access Control vulnerability OBB-3843604

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

NetBox Cross-Site Scripting Vulnerability

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox 3.7.0 and earlier versions, which stems from /core/config-revisions in the component Home Page...

CVE-2024-0948: Improper Neutralization of Input During Web Page Generation

DISPUTED A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input test leads to cross site scripting. The atta...

UBUNTU-CVE-2024-23817

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendere...

ncurses: Local users can trigger security-relevant memory corruption via malformed data

A vulnerability was found in ncurses and occurs when used by a setuid application. This flaw allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable...

CVE-2024-23817: Improper Neutralization of Input During Web Page Generation

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendere...

PT-2024-20098 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 18.0.4 Description: Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. The vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered...

Ring Will Stop Giving Cops a Free Pass on Warrantless Video Requests

The Amazon-owned home surveillance company says it is shuttering a feature in its Neighbors app that allows police to request footage from users. But it’s not shutting out the cops entirely...

How to lock out your ex-partner from your smart home

Stalkers can use all kinds of apps, gadgets, devices, and phones to spy on their targets, which are often their ex-partners. Unfortunately, while they no doubt have many positive uses, smart home devices give stalkers an array of tools to keep an eye on their targets. If you are the partner that...

BreachForums Founder Sentenced to 20 Years of Supervised Release, No Jail Time

Conor Brian Fitzpatrick has been sentenced to time served and 20 years of supervised release for his role as the creator and administrator of BreachForums. Fitzpatrick, who went by the online alias "pompompurin," was arrested in March 2023 in New York and was subsequently charged with conspiracy ...

johnsonfuneralhome.net Cross Site Scripting vulnerability OBB-3839457

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

What to do with that fancy new internet-connected device you got as a holiday gift

Welcome to 2024! The Threat Source newsletter is back after our winter break. When I wasnt spending my downtime chasing around my toddler, one of my main projects was to upgrade the internet connection at my house. My ISP started offering Gigabit speeds and a 60 GHz connection, which was appealin...