Malware distributor Storm-0324 facilitates ransomware access

The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment. Beginnin...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities affecting Adobe software. A cyber threat actor can exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the...

CVE-2023-4630 Missing Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports...

CVE-2023-4630 Missing Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports...

Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows

A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium. The activity has been codenamed Steal-It by Zscaler ThreatLabz. "In this...

CVE-2023-4877

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

Hardcoded credentials

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

Hardcoded credentials

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4877 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876

CVE-2023-4876 affects hamza417/inure (prior to build92). The root cause is improper validation of incoming intent.data in TTFViewerActivity, allowing content:// data to be opened via the app’s file provider and leading to exposure of sensitive files stored in external storage (e.g., Preferences.x...

CVE-2023-4876 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

CVE-2023-4876 Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92...

PT-2023-30943 · Inure · Inure

Name of the Vulnerable Software and Affected Versions: inure versions prior to build92 Description: The issue concerns exposure of sensitive information to an unauthorized actor in the GitHub repository hamza417/inure. Recommendations: For versions prior to build92, update to build92 or later to...

CVE-2023-41316 HTML Injection with email in Tolgee

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

Outlook Hack: Microsoft Reveals How a Crash Dump Led to a Major Security Breach

Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forge tokens and access Outlook by compromising an engineer's corporate account. This enabled the adversary to access a debugging environment that contained informatio...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to execute arbitrary code.

The vulnerability of the XWiki Platform lies in its lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...