Google Android Security Vulnerability

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android, which stems from improper validation of multiple method inputs in the ManagedServices.java file, and may exist a way to hide applications with...

Easy!Appointments Security Vulnerability

Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in Easy!Appointments, which stems from an insecure authorization issue in the /services/serviceId interface. A low-privileged attacker can exploit this vulnerability to gain access to,...

Microsoft Active Directory Domain Services Security Vulnerability

Microsoft Active Directory Domain Services is a key service from Microsoft Corporation USA for managing and organizing resources, users, computers, and other security objects in a network. A security vulnerability exists in Microsoft Active Directory Domain Services. An attacker could exploit the...

PT-2024-12689 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software name or affected versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /services/serviceId" endpoint allows a low-privileged user to fetch, modify, or delete the...

PT-2024-4743 · Microsoft · Active Directory Domain Services +3

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access control in the DCOM Remote Cross-Session Activation component of the Windows operating system. This can be exploited by a remote attacker to...

Microsoft WS-Discovery Security Vulnerability

Microsoft WS-Discovery is a web-based protocol from Microsoft Corporation USA. A security vulnerability exists in Microsoft WS-Discovery. An attacker has exploited the vulnerability to cause a denial of service on the system. The following products and editions are affected:Windows 10 Version 180...

PT-2024-4803

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a security feature bypass in Windows Cryptographic Services, allowing a remote attacker to bypass security restrictions. The vulnerability is associated with the use...

Microsoft Windows Cryptographic Services Security Vulnerability

Microsoft Windows Cryptographic Services is a cryptographic service provider program from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Cryptographic Services. An attacker exploiting this vulnerability could bypass certain features. The following products and...

Microsoft Windows Security Vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows MultiPoint Services. An attacker could exploit the vulnerability to remotely execute code. The following products and versions are...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code execution vulnerability exists in multiple Mozilla products that ...

KB5040570: Servicing stack update for Windows Server 2012: July 9, 2024

KB5040570: Servicing stack update for Windows Server 2012: July 9, 2024 End of support information Windows Server 2012 reached end of support EOS on October 10, 2023. Extended Security Updates ESUs are available for purchase and will continue for three years, renewable on an annual basis, until t...

New APT Group "CloudSorcerer" Targets Russian Government Entities

A previously undocumented advanced persistent threat APT group dubbed CloudSorcerer has been observed targeting Russian government entities by leveraging cloud services for command-and-control C2 and data exfiltration. Cybersecurity firm Kaspersky, which discovered the activity in May 2024, said...

Defend Against Account Abuse in Financial Services

Learn how Akamai Account Protector defends against account abuse by distinguishing between legitimate and malicious activities...

OESA-2024-1788 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: An issue was discovered in GNOME GLib...

The vulnerability of the web interface of the Cisco Crosswork Network Services Orchestrator software allows a hacker to carry out phishing attacks.

The vulnerability of the Cisco Crosswork Network Services Orchestrator software’s web interface relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks using a specially created malicious link...

Internet Bug Bounty: moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)

Moderate: Apache HTTP Server proxy encoding problem CVE-2024-38473 An encoding problem was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This issue allowed request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via...

What’s new in the MSRC Report Abuse Portal and API

The Microsoft Security Response Center MSRC has always been at the forefront of addressing cyber threats, privacy issues, and abuse arising from Microsoft Online Services. Building on our commitment, we have introduced several updates to the Report Abuse Portal and API, which will significantly...

aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

GHSA-JJ68-CP4V-98QF aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

CVE-2024-39324 aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...