CVE-2024-12259

The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.8120. This is due to the plugin not properly validating a user's identity prior to updating their email through the wcupdateuserdata AJAX...

WordPress plugin Biagiotti Membership 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. An authorization issue...

Security Bulletin: Security Vulnerabilities have been identified in IBM Java Runtime as shipped with Tivoli Federated Identity Manager

Summary IBM Java Runtime as shipped with Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IBM Java Runtime have been published in a security bulletin. Vulnerability Details CVEID:CVE-2019-2766 DESCRIPTION: Vulnerability in the Java SE, Java SE Embedded...

CISCO-SA-20190417-ISE

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:50+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666794397039731...

CISCO-SA-20191016-ISE

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:29+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666793115947068...

DoJ Indicts 14 North Koreans for $88M IT Worker Fraud Scheme Over Six Years

The U.S. Department of Justice DoJ has indicted 14 nationals belonging to the Democratic People's Republic of Korea DPRK or North Korea for their alleged involvement in a long-running conspiracy to violate sanctions and commit wire fraud, money laundering, and identity theft by illegally seeking...

CVE-2024-52059 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow', Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional Security Plugins allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from...

CVE-2024-52059 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow', Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional Security Plugins allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from...

ceph: rhceph-container: Authentication bypass in CEPH RadosGW

A vulnerability in the Ceph Rados Gateway RadosGW OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm alg. This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid token...

How easily access cards can be cloned and why your PACS might be vulnerable

TL;DR Access cards can be cloned There are practical measures to make card cloning difficult Practical guidance on how these systems work and why you should make sure they’re configured right What is a physical access control system? A physical access control system, or PACS, is the system that...

Seven Bolt-Ons to Make Your Entra ID More Secure for Critical Sessions

Identity security is all the rage right now, and rightfully so. Securing identities that access an organization's resources is a sound security model. But IDs have their limits, and there are many use cases when a business should add other layers of security to a strong identity. And this is what...

One Identity Named Winner of the Coveted Top InfoSec Innovator Awards for 2024

One Identity wins "Hot Company: Privileged Access Management" at the 12th Cyber Defense Magazine InfoSec Innovator Awards, showcasing PAM excellence in cybersecurity...

DRUPAL-CONTRIB-2024-067

This module enables you to authenticate users through an Identity Provider IdP or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is...

Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access

A critical security vulnerability has been disclosed in SailPoint's IdentityIQ identity and access management IAM software that allows unauthorized access to content stored within the application directory. The flaw, tracked as CVE-2024-10905 , has a CVSS score of 10.0, indicating maximum severit...

The vulnerability of the management software for Keycloak’s identification and access controls is related to the use of pre-set user accounts. This allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Keycloak identity and access management software relates to the use of pre-set user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

AI chatbot provider exposes 346,000 customer files, including ID documents, resumes, and medical records

Researchers have discovered a huge Google Cloud Storage bucket, found freely accessible on the internet and containing a treasure trove of personal information. AI startup WotNot provides companies with the ability to create their own customized chatbot. The company reportedly has 3,000 customers...

The Ultimate Guide to Designing a Logo Online: Tools, Tips, and Tricks

A logo is more than just a visual element—it’s the cornerstone of your brand identity. It communicates your…...

Omada Identity Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored Cross-Site Scripting product: Omada Identity vulnerable version: v15U1, v14.14 hotfix 309 fixed version: v15U1, v14.14 hotfix 309 CVE number: CVE-2024-52951 impact...

Unable to encrypt Identity disk on AWS when using encrypted master image

The AMI was created using an encrypted instance\snapshot. However, the MCS machines appear with identity disk "Not encrypted"...

PT-2024-35452 · Xid +1 · Xid +1

Name of the Vulnerable Software and Affected Versions: sftpgo versions prior to v2.6.4 Description: The OpenID Connect implementation in sftpgo allows authenticated users to brute force session cookies, gaining access to other users' data. This is because the cookies are generated predictably usi...