North Korean Hackers Target Developers with Malicious npm Packages

Threat actors with ties to North Korea have been observed publishing a set of malicious packages to the npm registry, indicating "coordinated and relentless" efforts to target developers with malware and steal cryptocurrency assets. The latest wave, which was observed between August 12 and 27,...

U.S. Agencies Warn of Iranian Hacking Group's Ongoing Ransomware Attacks

U.S. cybersecurity and intelligence agencies have called out an Iranian hacking group for breaching multiple organizations across the country and coordinating with affiliates to deliver ransomware. The activity has been linked to a threat actor dubbed Pioneer Kitten, which is also known as Fox...

Mattermost Permission Issues Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a permissions issue vulnerability that stems from a failure to properly enforce permissions, which can be exploited by an attacker to perform write operations on a team...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

CVE-2024-3980

Hitachi Energy CVE-2024-3980 affects MicroSCADA Pro/X SYS600 (and related MACH GWS components per ICS/CISA notes). The vulnerability arises from inadequate input validation that lets an authenticated user influence file paths/file names used in filesystem operations, enabling access or modificati...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

CVE-2024-3980

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application...

Authentication Bypass Vulnerability in Hitachi Ops Center Common Services

Overview Authentication bypass vulnerability exists in Hitachi Ops Center Common Services. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

PT-2024-28675 · Unknown · Microscada Pro/X Sys600

Name of the Vulnerable Software and Affected Versions: MicroSCADA Pro/X SYS600 affected versions not specified Description: The product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited, this issue allows the attack...

Hitachi Ops Center Common Services 安全漏洞

Hitachi Ops Center Common Services is a component of Hitachi, Ltd. of Japan Hitachi that provides single sign-on functionality and a web portal for Ops Center products. A security vulnerability exists in Hitachi Ops Center Common Services version 10.9.3-00 through versions prior to 11.0.2-01. An...

The vulnerability of the synchronize_rcu() function in the ipset component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the synchronizercu function in the ipset component of the Linux operating system is related to a decrease in performance during data caching operations. Exploiting this vulnerability can allow an attacker to cause service failures...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams...

SUSE CVE-2022-48939

In the Linux kernel, the following vulnerability has been resolved: bpf: Add schedule points in batch ops syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcubarrier Nothing prevents batch ops to...

Warehouse Inventory System Cross-Site Request Forgery Vulnerability (CNVD-2024-38210)

Warehouse Inventory System is a Warehouse Inventory Management System by Siamon Hasan Personal Developer. A cross-site request forgery vulnerability exists in Warehouse Inventory System v2.0, which stems from the addproduct.php component not adequately verifying that a request comes from a truste...

Kliqqi CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-37623)

Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version of a cross-site request forgery vulnerability , the vulnerability stems from /admin/domainmanagement.php?whitelistadd does not adequately verify that the request comes from a trusted user , an...

Kliqqi CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-37625)

Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version of a cross-site request forgery vulnerability , the vulnerability stems from /admin/submitpage.php does not adequately verify whether the request is from a trusted user , an attacker can use this...

Kliqqi CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-37622)

Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version exists cross-site request forgery vulnerability, the vulnerability stems from /admin/domainmanagement.php?id=0&list=whitelist&remove=pligg.com does not adequately verify whether the request is from ...

Kliqqi CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-37618)

Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version of the cross-site request forgery vulnerability , the vulnerability stems from /admin/admingroup.php?mode=delete&groupid=3 does not adequately verify whether the request is from a trusted user , an...

Kashipara Bus Ticket Reservation System 安全漏洞

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. An access control error vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which can be exploited by attackers to cause unauthorized operation...