LUCR-3: Scattered Spider Getting SaaS-y in the Cloud

LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875 and is a financially motivated attacker that leverages the Identity Provider IDP as initial access into an environment with the goal of stealing Intellectual Property IP for extortion. LUCR-3 targets Fortune 20...

Tenable Nessus SEoL (6.2.x)

According to its version, Tenable Nessus is 6.2.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

Apache Subversion Client SEoL (1.13.x)

According to its version, Apache Subversion Client is 1.13.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL...

Apache Subversion Client SEoL (1.4.x)

According to its version, Apache Subversion Client is 1.4.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL...

CVE-2023-44129

Summary: CVE-2023-44129 affects LG-patched Android Messaging (com.android.mms) via the exported activity com.android.mms.ui.QClipIntentReceiverActivity. An attacker can trigger the activity, broadcast the action com.lge.message.action.QCLIP, and send their own data with Intent.FLAG_GRANT_*; the p...

Cloud Backup "Inner SQL exception in the service provider infrastructure"

The error documented in this article can occur due to various reasons. This article specifically addresses a single scenario related to the underlying SQL database engine used by the Veeam Cloud Service Provider. The log snippet provided in the 'Cause' section offers context to help confirm wheth...

Hive Pro Partners with Tech Titan to Fortify Cybersecurity Landscape in Southeast Asia

HERNDON, VA., Sept. 26, 2023 - Hive Pro®, a pioneer vendor in Threat Exposure Management, is thrilled to announce a strategic partnership with Tech Titan Group, a leading IT Solutions Provider renowned for its innovation-driven approach and dedication to addressing evolving customer needs across...

CVE-2023-43457

An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint...

CVE-2023-43457

An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint...

CVE-2023-43457

An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint...

Code injection

An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint...

CVE-2023-43456

Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint...

CVE-2023-43456

Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint...

Cross site scripting

Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint...

CVE-2023-43457

An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint...

Service Provider Management System Cross-Site Scripting Vulnerability

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic websites for service provider companies. A cross-site scripting vulnerability exists in Service Provider Management System v.1.0 that could allow a...

CVE-2023-43456

Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint...

CVE-2023-43457

Service Provider Management System v1.0 is affected by a vulnerability in the /php-spms/admin/?page=user/ endpoint where an attacker can exploit an ID parameter to gain privileges. The issue, described across multiple sources, enables remote privilege escalation and is labeled as CRITICAL with CV...

PT-2023-28829 · Unknown · Service Provider Management System

Name of the Vulnerable Software and Affected Versions: Service Provider Management System version 1.0 Description: An issue in the system allows a remote attacker to gain privileges via the ID parameter in the "/php-spms/admin/?page=user/" endpoint. Recommendations: For version 1.0, consider...

Service Provider Management System Security Vulnerability

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic web sites for service provider companies. A security vulnerability exists in Service Provider Management System version v.1.0 that originates from a...