CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CentOS 9 : grafana-9.2.10-4.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the grafana-9.2.10-4.el9 build changelog. - account takeover possible when using Azure AD OAuth CVE-2023-3128 Note that Nessus has not tested for this issue but has instead relied only on t...

CentOS 9 : libldb-2.5.2-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libldb-2.5.2-1.el9 build changelog. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database...

How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin

Meet the guy who taught US intelligence agencies how to make the most of the ad tech ecosystem, "the largest information-gathering enterprise ever conceived by man."...

ad-zn.nl Improper Access Control vulnerability OBB-3859850

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. State Government Network Breached via Former Employee's Account

The U.S. Cybersecurity and Infrastructure Security Agency CISA has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee. "This allowed the threat actor to successfully authenticate to an internal...

Grafana Code Issue Vulnerability

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. Grafana has a security vulnerability that stems from a CSV datasource plugin that...

CSAM Strengthens Attack Surface Coverage and Risk Assessment With Third-Party Connectors

Organizations using Qualys CyberSecurity Asset Management CSAM can now import asset data from any external system into the Enterprise TruRisk Platform. With third-party connectors, you will identify any existing coverage gaps and add business context to your unified inventory, helping you...

Progress WS_FTP Server < 8.7.6, 8.8.x < 8.8.4 Arbitrary File Upload

The remote host is running a version of WSFTP earlier than 8.7.6 or 8.8.x prior to 8.8.4. It is, therefore, affected by an arbitrary file upload vulnerability in the Ad Hoc Transfer Mode module. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload...

ad-kindai.co.jp Improper Access Control vulnerability OBB-3843400

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Zelle Is Using My Name and Voice without My Consent

Okay, so this is weird. Zelle has been using my name, and my voice, in audio podcast ads--without my permission. At least, I think it is without my permission. Its possible that I gave some sort of blanket permission when speaking at an event. Its not likely, but it is possible. I wrote to Zelle...

ad-hoc-news.de Cross Site Scripting vulnerability OBB-3836511

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

EulerOS Virtualization 2.11.0 : libldb (EulerOS-SA-2023-2758)

According to the versions of the libldb package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient an...

EulerOS Virtualization 2.11.1 : libldb (EulerOS-SA-2023-2727)

According to the versions of the libldb package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient an...

S-CMS SQL Injection Vulnerability

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A SQL injection vulnerability exists in S-CMS version 2.0build20220529-20231006 and earlier versions, which originates from a problem with the unknown function of /member/ad.php?action=ad...

Happy 14th Birthday, KrebsOnSecurity!

KrebsOnSecurity celebrates its 14th year of existence today! I promised myself this post wouldnt devolve into yet another Cybersecurity Year in Review. Nor do I wish to hold forth about whatever cyber horrors may await us in 2024. But I do want to thank you all for your continued readership,...

CVE-2023-51010

An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking...

com.sdjictec.qdmetro Security Vulnerabilities

com.sdjictec.qdmetro is a component. A security vulnerability exists in com.sdjictec.qdmetro version 4.2.2, which originates in the component AdSdkH5Activity that allows an attacker to send and directly open a malicious URL, or download a malicious application...

Citrix DaaS: Single sign-on (SSO) not working after enabling FAS

In the DaaS environment, Single sign-onSSO did not work after enabling FAS, and users were prompted to enter credentials. FAS was enabled with Azure AD as IDP in a single-domain environment. Event ID 105, 120 and 121 logged on the FASServer,indicated that the Certificate wasissued by the Windows...

CVE-2022–26923 aka Certifried

Active Directory Domain Services Elevation of Privilege Vulnerability. Recent assessments: cdelafuente-r7 at January 10, 2023 3:08pm UTC reported: This vulnerability enables a low-privileged user to escalate privileges in a default Active Directory environment with the Active Directory Certificat...