1E Platform SQL Injection Vulnerability

1E Platform is a terminal endpoint management and automation solution from 1E. A security vulnerability exists in 1E Platform versions prior to v8.1.2, prior to v8.4.1, prior to v9.0.1, and prior to v23.7.1 SaaS, which stems from the incorrect neutralization of special elements used in SQL...

PT-2023-29444 · 1E · 1E Platform Saas +1

Name of the Vulnerable Software and Affected Versions: 1E Platform versions 8.1.2 through 9.0.1 1E Platform SaaS versions prior to 23.7.1 Description: The issue is a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this...

CVE-2023-45159

1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available from the 1E support...

CVE-2023-45159

1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available from the 1E support...

Arbitrary file deletion

1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available from the 1E support...

CVE-2023-45159 1E Client installer can perform arbitrary file deletion on protected files

1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available from the 1E support...

CVE-2023-45159 1E Client installer can perform arbitrary file deletion on protected files

1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available from the 1E support...

Wing Disrupts the Market by Introducing Affordable SaaS Security

Today, mid-sized companies and their CISOs are struggling to handle the growing threat of SaaS security with limited manpower and tight budgets. Now, this may be changing. By focusing on the critical SaaS security needs of these companies, a new approach has emerged that can be launched for $1,50...

CVE-2023-37998

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3...

CVE-2023-37998

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler plugin = 3.0.3 versions...

CVE-2023-37998 WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3...

CVE-2023-37998

CVE-2023-37998 : A CSRF vulnerability in the WordPress plugin Saas Disabler affects versions

PT-2023-26243 · Unknown · Saas Disabler

Name of the Vulnerable Software and Affected Versions: Saas Disabler versions 3.0.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Saas Disabler, allowing unauthorized actions to be performed on behalf of a user without their knowledge. This can be exploited by an...

LUCR-3: Scattered Spider Getting SaaS-y in the Cloud

LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875 and is a financially motivated attacker that leverages the Identity Provider IDP as initial access into an environment with the goal of stealing Intellectual Property IP for extortion. LUCR-3 targets Fortune 20...

The Rise of the Malicious App

Security teams are familiar with threats emanating from third-party applications that employees add to improve their productivity. These apps are inherently designed to deliver functionality to users by connecting to a "hub" app, such as Salesforce, Google Workspace, or Microsoft 365. Security...

Design/Logic Flaw

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One on-prem and SaaS, Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that a...

CVE-2023-41179

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One on-prem and SaaS, Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that a...

CVE-2023-41179

CVE-2023-41179 affects Trend Micro Apex One (on‑prem and SaaS) and Worry‑Free Business Security products, via a vulnerability in the third‑party AV uninstaller module that could allow arbitrary code execution. An attacker must have administrative console access to exploit the issue, and the vulne...

Avoid These 5 IT Offboarding Pitfalls

Employee offboarding is no one's favorite task, yet it is a critical IT process that needs to be executed diligently and efficiently. That's easier said than done, especially considering that IT organizations have less visibility and control over employees' IT use than ever. Today, employees can...