Google Chrome Vulnerability Exposes Data of 2.5 Billion Users

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A vulnerability in Google Chrome could affect over 2.5 billion users. An attacker can exploit this vulnerability for the theft of sensitive files, such as crypto wallets and cloud provider...

CVE-2023-21893

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful...

Code injection

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful...

PT-2023-14606 · Dell · Solution Enabler Vapp +2

Name of the Vulnerable Software and Affected Versions: Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x Description: The issue allows a low privileged remote attacker to potentially exploit an information disclosure vulnerability, leading to the...

Gartner® Report: Questions to Ask When Selecting an MDR Provider

Measuring against the right criteria The “right” criteria is whatever works to further your security organization’s specific needs in detection and response D&R. There’s only so much budget to go around—and successfully obtaining a significant year-over-year increase can be rare. The last thing...

PT-2023-1244 · Oracle · Oracle Data Provider For .Net +1

Name of the Vulnerable Software and Affected Versions: Oracle Data Provider for .NET versions 19c through 21c Description: The issue is related to insufficient input validation in the Oracle Data Provider for .NET component of Oracle Database Server, allowing an unauthenticated attacker with...

PT-2023-9891 · Unknown · Simplesamlphp +1

Name of the Vulnerable Software and Affected Versions: simplesamlphp simplesamlphp-module-openidprovider versions up to 0.8.x Description: A vulnerability was found in the simplesamlphp simplesamlphp-module-openidprovider. The issue affects an unknown functionality of the file...

Oracle Database Server 安全漏洞

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing, and other functions. A security vulnerability exists in Oracle Database Server versions 19c and 21c. An...

simplesamlphp-module-openidprovider 跨站脚本漏洞

simplesamlphp-module-openidprovider is a simplesamlphp open source application. A cross-site scripting vulnerability exists in simplesamlphp-module-openidprovider version 0.8.x and earlier versions, which stems from the fact that incorrect manipulation of the parameter StateID can lead to...

A Secure User Authentication Method – Planning is More Important than Ever

When considering authentication providers, many organizations consider the ease of configuration, ubiquity of usage, and technical stability. Organizations cannot always be judged on those metrics alone. There is an increasing need to evaluate company ownership, policies and the stability, or...

Command Execution Vulnerability in Damon Database Management System (DM8) Kirin Version

Wuhan Damon Database Co., Ltd. is a database product development service provider. A command execution vulnerability exists in Damon Database Management System DM8 Kirin Edition, which can be exploited by attackers to execute arbitrary commands...

Siemens Mendix SAML Module Cross-Site Scripting Vulnerability (CNVD-2023-02702)

The Mendix SAML module uses SAML to authenticate users in cloud applications. The module can communicate with any identity provider that supports SAML 2.0 or Shibboleth. A cross-site scripting vulnerability exists in Siemens Mendix SAML Module, which can be exploited by attackers to extract...

CVE-2022-4037

An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth...

CVE-2023-22405 Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot

An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service DoS to device due to out of resources. When a device...

CVE-2022-4037

An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth...

CVE-2022-4037

Removed by vendor...

PT-2023-13788 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.5.7 GitLab CE/EE versions 15.6.0 through 15.6.3 GitLab CE/EE versions 15.7.0 through 15.7.1 Description: A race condition in GitLab CE/EE can lead to verified email forgery and takeover of third-party account...

CVE-2023-22405

CVE-2023-22405 describes a DoS in Juniper Networks Junos OS caused by an improper preservation of consistency between independent representations of shared state in the Packet Forwarding Engine (PFE). When devices run with service-provider/SP style switching and MAC limiting on an Aggregated Ethe...

CVE-2022-4037

An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth...

Google Chrome “SymStealer” Vulnerability: How to Protect Your Files from Being Stolen

The Imperva Red Team recently disclosed a vulnerability, dubbed CVE-2022-3656, affecting over 2.5 billion users of Google Chrome and Chromium-based browsers. This vulnerability allowed for the theft of sensitive files, such as crypto wallets and cloud provider credentials. Introduction Chrome is...