2023 OWASP Top-10 Series: API8:2023 Security Misconfiguration

Welcome to the 9th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API8:2023 Security Misconfiguration. In this series we are taking an in-depth look at each category – the details, the impact and...

PT-2023-27679 · Moosocial · Moosocial

Name of the Vulnerable Software and Affected Versions: mooSocial MooSocial Software version Demo Description: The issue allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. This is a Cross Site Request Forgery vulnerability. Recommendations: For...

Malware Scanning: An Essential Layer of Website Security

Wordfence recently launched Wordfence CLI, a high performance command line malware scanner, which makes use of our extensive set of malware detection signatures to rapidly scan file systems for infections. In recent years, the WordPress community has seen a shift in emphasis towards prevention,...

Hive Pro Celebrates Remarkable Milestones in Securicom MSSP Partnership

HERNDON, VA., Sept. 13, 2023 - Hive Pro®, a pioneer vendor in Threat Exposure Management, is thrilled to announce significant achievements in its collaboration with Securicom, a customer-centric Global Managed IT Security Services Provider MSSP. This partnership marks a crucial step forward in...

CISA Adds Two Known Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-36761 Microsoft Word Information Disclosure Vulnerability CVE-2023-36802 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability These types of...

CISA Adds Two Known Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-41064 Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow CVE-2023-41061 Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability These types of...

EmploLeaks - Finding Leaked Employees Info for the Win

Developed by Faraday security researchers, this cutting-edge tool utilizes the power of OpenSource Intelligence techniques. EmploLeaks extracts valuable insights by scouring various platforms, to compile a comprehensive list of employees associated with a given company and cross-reference these...

Supply chain related security risks, and how to protect against them

By definition, a supply chain is the network of all the individuals, organizations, resources, activities and technology involved in the creation and sale of a product. In only a few rare cases does one organization have full control over every step in the entire process. The links in such a supp...

PT-2023-24036 · Power · Power

Name of the Vulnerable Software and Affected Versions: In power affected versions not specified Description: The issue is related to a possible out of bounds write due to an insecure default value, which could lead to local escalation of privilege. System execution privileges are needed for...

latelierlm.com Cross Site Scripting vulnerability OBB-3628689

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-16762 · Unknown · Dependency-Track-Policy-Applier

Name of the Vulnerable Software and Affected Versions: dependency-track-policy-applier affected versions not specified Description: The issue concerns the management of OWASP Dependency-Track policy. It involves creating a policy with projects and tags and adding conditions. Recommendations: At t...

PT-2023-23202 · Schweitzer Engineering Laboratories · Acselerator Quickset

Name of the Vulnerable Software and Affected Versions: Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software versions through 7.1.3.0 Description: An Inclusion of Functionality from Untrusted Control Sphere issue could allow an attacker to embed instructions that could be...

August 2023: GitHub PoCs, Vulristics, Qualys First-Party, Tenable ExposureAI, SC Awards and Rapid7, Anglo-Saxon list, MS Patch Tuesday, WinRAR, Juniper

August 2023: GitHub PoCs, Vulristics, Qualys First-Party, Tenable ExposureAI, SC Awards and Rapid7, Anglo-Saxon list, MS Patch Tuesday, WinRAR, Juniper. Hello everyone! This month I decided NOT to make an episode completely dedicated to Microsoft Patch Tuesday. Instead, this episode will be an...

CVE-2017-20186 nikooo777 ckSurf Spectator List Name misc.sp SpecListMenuDead denial of service

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The...

PT-2023-27618 · Phpjabbers · Phpjabbers Ticket Support Script

Name of the Vulnerable Software and Affected Versions: PHPJabbers Ticket Support Script version 3.2 Description: There is a Cross Site Scripting XSS issue in the message parameter of "index.php" in PHPJabbers Ticket Support Script. This allows for potential malicious script execution...

PT-2023-27080 · Unknown · Free/Open Source Inventory Management System

Name of the Vulnerable Software and Affected Versions: Free and Open Source Inventory Management System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Member...

PT-2023-6904 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium version 11.4 Description: The issue is related to SQL injection, where a remote attacker could send specially crafted SQL statements to view, add, modify, or delete information in the back-end database. This is due to th...

Rapid7 Takes 2023 SC Awards for Vulnerability Management and Threat Detection

The highly respected SC Awards program, hosted by SC Media, recognizes the solutions, organizations, and people driving innovation and success in information security. Now in its 26th year, the SC Awards continue to grow and evolve. Rapid7 is proud to announce we have received not one, but two...

PT-2023-27063 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 Description: A buffer overflow issue was discovered via the function fgets. Recommendations: For Tenda AC6 version US AC6V1.0BR V15.03.05.16, consider restricting access to the function fgets until ...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-24489 Citrix Content Collaboration ShareFile Improper Access Control Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber...