2902 matches found
CVE-2023-5035 Cookie Without Secure Flag
A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks,...
CVE-2023-4217 Session cookies attribute not set properly
A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...
CVE-2023-4217 Session cookies attribute not set properly
A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...
Starting your journey to become quantum-safe
There’s no doubt we are living through a time of rapid technological change. Advances in ubiquitous computing and ambient intelligence transform nearly every aspect of work and life. As the world moves forward with new advancements and distributed technologies, so too does the need to understand...
Starting your journey to become quantum-safe
There’s no doubt we are living through a time of rapid technological change. Advances in ubiquitous computing and ambient intelligence transform nearly every aspect of work and life. As the world moves forward with new advancements and distributed technologies, so too does the need to understand...
FDA medical IoT cyber device compliance. FD&C 524b
TL;DR FD&C 524b is new FDA legislation for medical cyber device compliance Introduced on March 30th 2023 it is now a firm requirement as of October 1st 2023 It demands provision of complex evidence that manufacturers take security seriously Medical cyber device market There are over 10,000 medica...
PT-2023-32099 · WordPress · Jquery News Ticker Plugin
Name of the Vulnerable Software and Affected Versions: Jquery news ticker plugin for WordPress versions up to, and including, 3.0 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...
U.S. Dept Of Defense: Elasticsearch is currently open without authentication on https://██████l
An Elasticsearch instance accessible at https://██████l was found to be open without authentication, exposing data to unauthorized access. The vulnerability allowed listing and extraction of sensitive data stored in the Elasticsearch indexes. To mitigate, authentication and authorization controls...
Make API Management Less Scary for Your Organization
While application development has evolved rapidly, the API management suites used to access these services remain a spooky reminder of a different era. Introducing new API management infrastructure with these legacy models still poses challenges for organizations as they modernize. Transitioning...
Who's Experimenting with AI Tools in Your Organization?
With the record-setting growth of consumer-focused AI productivity tools like ChatGPT, artificial intelligence—formerly the realm of data science and engineering teams—has become a resource available to every employee. From a productivity perspective, that's fantastic. Unfortunately for IT and...
Nextcloud: Delete external storage of any user
An external storage vulnerability was discovered that allowed standard users to delete external storage resources from any user account in the application. By modifying a system-generated ID, unauthorized users could remove externally linked storage without special privileges, potentially resulti...
PT-2023-20534 · Node-Qpdf · Node-Qpdf
Name of the Vulnerable Software and Affected Versions: node-qpdf versions all Description: The issue arises from the encrypt method failing to sanitize its parameter input, which later flows into a sensitive command execution API. This allows attackers to inject malicious commands once they can...
Possibility of security vulnerabilities introduced by creating ERC20ProxyDelegator instances on the fly using static salt values
Lines of code Vulnerability details Impact Security risks associated with deploying proxy contracts via deterministic addresses that can be easily calculated. In deployProxyDelegatorIfNeeded, in the case that extcodesizeproxyAddress == 0, then a proxy contract is instantiated ad hoc via new...
Webinar: How vCISOs Can Navigating the Complex World of AI and LLM Security
In today's rapidly evolving technological landscape, the integration of Artificial Intelligence AI and Large Language Models LLMs has become ubiquitous across various industries. This wave of innovation promises improved efficiency and performance, but lurking beneath the surface are complex...
Missing Access Control in setLimit Function
Lines of code Vulnerability details Impact The setLimit function does not have proper access control, allowing anyone to modify the revocableLimit and irrevocableLimit variables. This can lead to potential security risks and unintended changes to these limits. Proof of Concept no access control o...
Latest Trend in Mac Vulnerabilities and How to Efficiently Address Them
Usually, every September/October, Apple releases its updated OSes and, with them, a set of new CVEs. This month was no different. In fact, if we look at 2023, Qualys released on average 32 new QIDs every month for MacOs and its 3rd-party products see figure below: Fig 1. Mac Vulns 2023 In the pas...
How Account Opening Abuse Affects 6 Industries
...
Live Webinar: Overcoming Generative AI Data Leakage Risks
As the adoption of generative AI tools, like ChatGPT, continues to surge, so does the risk of data exposure. According to Gartner's "Emerging Tech: Top 4 Security Risks of GenAI" report, privacy and data security is one of the four major emerging risks within generative AI. A new webinar featurin...
DDoS 2.0: IoT Sparks New DDoS Alert
The Internet of Things IoT is transforming efficiency in various sectors like healthcare and logistics but has also introduced new security risks, particularly IoT-driven DDoS attacks. This article explores how these attacks work, why they're uniquely problematic, and how to mitigate them. What I...
