Cross site scripting

PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this...

CVE-2024-21627 Some attribute not escaped in Validate::isCleanHTML method

PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this...

Mastering Industrial Cybersecurity: The Significance of Combining Vulnerability Management with Detection and Response

Written by Elad Ben-Meir, CEO SCADAfence, a Honeywell company. In today's digital era, where industries are increasingly reliant on advanced technologies, safeguarding critical infrastructure against cyber threats has become paramount. The convergence of operational technology OT and information...

TV Bro Security Breach

TV Bro is truefedex Personal Developer's simple web browser for Android, optimized to work with TV remotes. A security vulnerability exists in truefedex TV Bro 2.0.0 and earlier versions, which stems from a WebView error handling, and allows an attacker to execute arbitrary code, create arbitrary...

Pexip Infinity Security Vulnerability

Pexip Infinity is a cloud collaboration platform for video conferencing from Pexip Norway. The product provides high quality and secure cloud conferencing capabilities. A security vulnerability exists in Pexip Infinity prior to version 32, which stems from a cross-site scripting XSS vulnerability...

How Strata Identity and Microsoft Entra ID solve identity challenges in mergers and acquisitions

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Along with every merger and acquisition between two companies comes the need to combine and strengthen their IT infrastructure. In particular, there is an immediate and profound impa...

CVE-2023-47565 Legacy VioStor NVR

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmwar...

EnBw SENEC Legacy Storage Box Security Vulnerability

EnBw SENEC Legacy Storage Box is a series of storage boxes from EnBw Germany. A security vulnerability exists in EnBw SENEC Legacy Storage Box versions V1 through V3, which stems from the use of publicly available default credentials with administrative privileges...

EnBw SENEC Legacy Storage Box Security Vulnerability

The EnBw SENEC Legacy Storage Box is a series of storage boxes from the German company EnBw. A security vulnerability exists in EnBw SENEC Legacy Storage Box versions V1, V2, and V3, which stems from an administrator credentials disclosure, and can be exploited by an attacker to gain access to th...

CLSA-2023-1701799960 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-45871 - igb: Limit maximum frame Rx based on MTU - igb: Only sync size of expected frame in ethtool testing - igb: Add support for ethtool private flag to allow use of legacy Rx - igb: Add support for using order 1 pages to receive large frames - igb:...

Updated kernel-linus packages fix security vulnerabilities

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues: A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue ma...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 4 (5.4.4-141)

This update provides stability and performance improvements. Vulnerability id: VSTOR-77889 Cannot download updates if some incompatible legacy packages are installed. Vulnerability id: VSTOR-77910 Nginx cannot start after an update due to a legacy certificate format. Vulnerability id: VSTOR-75705...

SUSE CVE-2023-6206

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox 12...

Restrict Content < 3.2.8 - Information Exposure via legacy log file

Description The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.7 via the legacy log file. This makes it possible for unauthenticated attackers to extract sensitive data including debug information...

ClickHouse Security Breach

ClickHouse is ClickHouse's fastest and most resource-efficient open source database for real-time applications and analytics. A security vulnerability exists in versions prior to ClickHouse 22.9.1.2603. An attacker exploited the vulnerability to cause the server to crash...

xorg-x11-server: Use-after-free bug in DestroyWindow

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod mode if the pointer is warped from within a window on one screen to the root window of the othe...

Product Walkthrough: Silverfort's Unified Identity Protection Platform

In this article, we will provide a brief overview of Silverfort's platform, the first and currently only unified identity protection platform on the market. Silverfort's patented technology aims to protect organizations from identity-based attacks by integrating with existing identity and access...

EnBw SENEC Legacy Storage Box Access Control Error Vulnerability

EnBw SENEC Legacy Storage Box is a series of storage boxes from EnBw Germany. An Access Control Error vulnerability exists in EnBw SENEC legacy storage Box versions V1 through V3, which stems from improper access control and leads to log disclosure...

shadow-utils security and bug fix update

2:4.6-19 - gpasswd: fix password leak. Resolves: 2215947 2:4.6-18 - Update patch to close label to reset libselinux state. Resolves: 1984740 - useradd: check if subid range exists for user. Resolves: 2012929 - findnewguid: Skip over IDs that are reserved for legacy reasons. Resolves: 1994269...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...