CISA Flags 6 Vulnerabilities - Apple, Apache, Adobe, D-Link, Joomla Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added six security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. This includes CVE-2023-27524 CVSS score: 8.9, a high-severity vulnerability impacting the Apache Superset...

January 9, 2024—KB5034129 (OS Build 20348.2227)

None None...

PT-2024-1099

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to errors in the representation of information by the user interface of the Windows operating system, specifically in the Themes component. This can allow a remote attack...

Inconsistent Display of Machine Names in Studio

Some machine names are displayed in lower case letters in the machine catalog, while all others are displayed in upper case letters. All machines have been created in the same way and were all added manually to the catalogue. The names are being displayed consistently in AD and the PVS console...

PT-2024-1126 · Microsoft · Lsass +1

Name of the Vulnerable Software and Affected Versions: Microsoft Local Security Authority Subsystem Service affected versions not specified Description: The issue is related to a lack of protection for service data in the Local Security Authority Subsystem Service LSASS of the Windows operating...

Ruby on Rails: DoS with crafted "Range" header

The vulnerability was discovered in the Active Storage component of Ruby on Rails. The vulnerability allowed an attacker to craft a "Range" header that could lead to a Denial of Service DoS attack. The attack was possible due to the lack of validation on overlapping ranges in the...

Security Bulletin: IBM Storage Fusion HCI uses hard-coded credentials for its own authentication with Active File Management (CVE-2023-50948)

Summary IBM Storage Fusion HCI uses default credentials for Active File Management AFM authentication. Vulnerability Details CVEID:CVE-2023-50948 DESCRIPTION: IBM Storage Fusion HCI contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound...

Improper Authorization

github.com/mattermost/mattermost/ is vulnerable to Improper Authorization. The vulnerability is caused when user receives updated permissions during active session. This freshly demoted guest can change group names...

ADFS Relying Party Trusts Disclosure

Microsoft Active Directory Federation Services ADFS is a very popular Single Sign On SSO feature offering identity federation to organizations. An ADFS server can be configured to show a login page to connect to corporate applications directly from this Identity Provider IdP. When enabled, this w...

Metasploit 2023 Annual Wrap-Up: Dec. 29, 2023

As 2023 winds down, we’re taking another look back at all the changes and improvements to the Metasploit Framework. This year marked the 20th anniversary since Metasploit version 1.0 was committed and the project is still actively maintained and improved thanks to a thriving community. Version 6....

PYSEC-2023-271

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

CVE-2023-51663 Hail authentication can be bypassed by changing email address

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

CVE-2023-51663 Hail authentication can be bypassed by changing email address

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

CVE-2023-51505

Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6...

CVE-2023-51505

Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6...

CVE-2023-51505

CVE-2023-51505 describes a deserialization of untrusted data vulnerability in the WordPress plugin Active Products Tables for WooCommerce (Profit-Products-Tables-for-WooCommerce) . The issue affects the plugin’s Professional/Active Products Tables for WooCommerce store extension from an unknown s...

PT-2023-31842 · Woocommerce · Active Products Tables For Woocommerce

Name of the Vulnerable Software and Affected Versions: Active Products Tables for WooCommerce versions 1.0.6 and earlier Description: The issue is related to Deserialization of Untrusted Data in Active Products Tables for WooCommerce, which affects professional products tables for WooCommerce...

Vulnerability fixed in NetApp Active IQ Unified Manager

NetApp has fixed a vulnerability in the Spring Web Services component of Active IQ Unified Manager for Windows, Linux, and VMware vSphere. The vulnerability allows a malicious party to gain access to sensitive data, potentially to manipulate it, or to cause a denial-of-service. NetApp has release...

CVE-2023-50448

In ActiveAdmin aka Active Admin before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data that belongs to another user by making CSV export requests at certain specific times...

Active Admin security vulnerability

Active Admin is Active Admin open source a Ruby on Rails framework . It is used to create a backend for website management. A security vulnerability exists in versions prior to Active Admin 2.12.0 that originated from allowing an attacker to access another user's private data by initiating a CSV...