CVE-2025-29526

A Cross-Site Scripting XSS vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execute arbitrary Javascript via injecting a crafted payload into the SearchTerm parameter...

DOGE Worker’s Code Supports NLRB Whistleblower

A whistleblower at the National Labor Relations Board NLRB alleged last week that denizens of Elon Musk's Department of Government Efficiency DOGE siphoned gigabytes of data from the agency's sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB...

CVE-2025-29526

A Cross-Site Scripting XSS vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execute arbitrary Javascript via injecting a crafted payload into the SearchTerm parameter...

CVE-2025-29526

A Cross-Site Scripting XSS vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execute arbitrary Javascript via injecting a crafted payload into the SearchTerm parameter...

Q4 Investor Relations Platform 安全漏洞

Q4 Investor Relations Platform is an investor relations platform from Q4 Canada. A security vulnerability exists in Q4 Investor Relations Platform version v5.147.1.2, which stems from an unfiltered input to the SearchTerm parameter in the search function, and could lead to a cross-site scripting...

PT-2025-17651 · Q4 · Q4 Inc Investor Relations Platform

Name of the Vulnerable Software and Affected Versions: Q4 Inc Investor Relations Platform version 5.147.1.2 Description: A Cross-Site Scripting XSS issue in the search function allows attackers to execute arbitrary Javascript by injecting a crafted payload into the SearchTerm parameter. This...

CVE-2025-29526

A Cross-Site Scripting XSS vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execute arbitrary Javascript via injecting a crafted payload into the SearchTerm parameter...

CVE-2025-0598

A stored Cross-site Scripting XSS vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session...

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [20 January]

As the digital world becomes more complicated, the lines between national security and cybersecurity are starting to fade. Recent cyber sanctions and intelligence moves show a reality where malware and fake news are used as tools in global politics. Every cyberattack now seems to have deeper...

This Week in Spring - October 22nd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring. I write this to you in an Uber speeding down the autobahn near Frankfurt, Germany. What a time to be alive! At the rate this driver's going, I won't have much time to write this before we've arrived, so let's dive right into...

Sensitive Information Exposure

github.com/juju/juju is vulnerable to Sensitive Information Exposure. The vulnerability is due to the leak of the sensitive context ID, allowing a local unprivileged attacker to access other sensitive data or relations accessible to the local charm...

RedJuliett Cyber Espionage Campaign Hits 75 Taiwanese Organizations

A likely China-linked state-sponsored threat actor has been linked to a cyber espionage campaign targeting government, academic, technology, and diplomatic organizations in Taiwan between November 2023 and April 2024. Recorded Future's Insikt Group is tracking the activity under the name...

CVE-2023-47123 iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0...

GHSA-H3M7-RQC4-7H9P Integer overflow in chunking helper causes dispatching to miss elements or panic

Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The issue may also lead to a panic rendering the server unavailable The following API methods are affected: - CheckPermission -...

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections

During our monitoring of Earth Lusca, we noticed a new campaign that used Chinese-Taiwanese relations as a social engineering lure to infect selected targets...

An integrated incident response solution with Microsoft and PwC

Today Microsoft Incident Response is excited to announce a new collaboration with PwC to expand our joint incident response and recovery capability. In this global alliance, Microsoft begins the initial containment and investigation, bringing a deep understanding of a company’s infrastructure to...

OpenFGA Security Vulnerabilities

OpenFGA is OpenFGA's high-performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in OpenFGA versions prior to 1.3.1, which stems from the fact that OpenFGA is susceptible to denial-of-service attacks when certa...

PT-2023-28896 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 1.3.2 Description: OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. This can cause the server to...

Strapi Information Disclosure Vulnerability

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.11.7, which stems from an information disclosure vulnerability in which the /content-manager/relations route does not remove private fields...

OpenFGA 安全漏洞

OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in OPenFGA v1.1.0 and earlier versions, which stems from the vulnerability of OPenFGA to denial-of-service attacks when executing...