Sweet Security Announces Availability of its Cloud Native Detection & Response Platform on the AWS Marketplace

TEL AVIV, Israel, 11th November 2024, CyberNewsWire...

Denial Of Service (DoS)

Mattermost is vulnerable to Denial of Service DoS. The vulnerability is due to the failure to prevent detailed error messages from being displayed in Playbooks, which allows an attacker to generate a large GraphQL response. This can lead to application crashes when a specially crafted request is...

[SECURITY] Fedora 41 Update: python-werkzeug-3.0.6-1.fc41

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

The Importance of Effective Incident Response

With cybersecurity threats continuously evolving, having a strong incident response IR plan is crucial for businesses of all…...

CVE-2024-11051 AMTT Hotel Broadband Operation System online_status.php sql injection

A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204. It has been classified as critical. Affected is an unknown function of the file /manager/frontdesk/onlinestatus.php. The manipulation of the argument AccountID leads to sql injection. It is possible to launch t...

CVE-2024-11050 AMTT Hotel Broadband Operation System language.php cross site scripting

A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204 and classified as problematic. This issue affects some unknown processing of the file /language.php. The manipulation of the argument LangID/LangName/LangEName leads to cross site scripting. The attack may be...

CVE-2024-11049 ZKTeco ZKBio Time Image File photo direct request

A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /authfiles/photo/ of the component Image File Handler. The manipulation leads to direct request. It is possible to launch the attack remotely. The complexity of an atta...

CVE-2024-11026

CVE-2024-11026 affects Intelligent Apps Freenow App 12.10.0 on Android. The issue resides in the Keystore Handler’s SSL.java (ch/qos/logback/core/net/ssl/SSL.java), where the argument DEFAULT_KEYSTORE_PASSWORD is manipulated with the input value “changeit,” resulting in a hard-coded password. Thi...

Wordfence Price Increases Coming December 5th, 2024

We haven't raised our prices in a relatively high inflation environment in 2 years, and in the case of Wordfence Care and Response, for 2.5 years. So that time has come, and we want to let our free and paid user community know ahead of time. We’re giving you almost a month forewarning before we...

CVE-2024-50599

CVE-2024-50599 describes a reflected Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) 8.8.15 , affecting a webmail calendar endpoint. The issue arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in...

PT-2024-33294 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: An issue was discovered in Logpoint where SOAR uses a static JWT secret key to generate tokens, allowing access to SOAR API endpoints without authentication. This enables attackers to create custo...

CVE-2024-50599

A reflected Cross-Site Scripting XSS vulnerability has been identified in Zimbra Collaboration Suite ZCS 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the...

RHEL 8 : httpd:2.4 (RHSA-2024:6468)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6468 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Security issues via?backe...

RHEL 8 : httpd:2.4 (RHSA-2024:6467)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6467 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Security issues via?backe...

CVE-2024-10927

MonoCMS CVE-2024-10927 affects the Account Information Page (/monofiles/account.php); the vulnerability is a cross-site scripting flaw triggered by the userid argument, enabling remote exploitation. Multiple sources confirm it affects versions up to 20240528 and that the exploit has been publicly...

CVE-2024-52043

Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation user enumeration.This issue affects all released HumHub versions: through 1.16.2...

CVE-2024-52043

HumHub CVE-2024-52043 affects HumHub up to version 1.16.2. The issue stems from error messages that expose sensitive information, enabling user enumeration. Impact is described as potential exposure of user data via observable responses on Linux deployments. Connected documents consistently refer...

CVE-2024-52043 User enumeration in HubHub

Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation user enumeration.This issue affects all released HumHub versions: through 1.16.2...

PT-2024-35101 · Humhub · Humhub

Name of the Vulnerable Software and Affected Versions: HumHub versions through 1.16.2 Description: The issue affects HumHub, allowing excavation through user enumeration due to an observable response discrepancy. This discrepancy can lead to the generation of error messages containing sensitive...

Security Bulletin: IBM Sterling Control Center is vulnerable to User Enumeration

Summary User Enumeration is affecting v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-35114 DESCRIPTION: IBM Sterling Control Center could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. CWE:CWE-204: Observable Response Discrepancy...