CVE-2023-24426

Jenkins Azure AD Plugin 303.va91ef20ee49f and earlier does not invalidate the previous session on login...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.7 Multiple Vulnerabilities (CloudBees Security Advisory 2023-01-24)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.7. It is, therefore, affected by multiple vulnerabilities including the following: - Sandbox bypass vulnerability in Script Security Plugin CVE-2023-24422 - CSRF...

CVE-2023-24426

The CVE-2023-24426 entry refers to Jenkins Azure AD Plugin (versions 303.va_91ef20ee49f and earlier) that does not invalidate an existing session on login. This behavior can allow an attacker with social engineering to gain administrator access to Jenkins, per Jenkins advisory notes. The issue is...

Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps

Researchers have shut down an "expansive" ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. "VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack...

CVE-2022-43959

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldapserveredit.php...

Default credentials

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldapserveredit.php...

CVE-2022-43959

Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldapserveredit.php...

CVE-2022-43959

The CVE-2022-43959 entry concerns 1C-Bitrix Bitrix24 (through version 22.200.200) with an issue in AD/LDAP server settings where credentials are insufficiently protected. The root cause is exposure of an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit....

Massive Ad Fraud Scheme Shut Down: 11 Million Phones Targeted

By Waqas The ad fraud was discovered while the researchers were investigating an iOS application that had been heavily impacted by an app spoofing attack. This is a post from HackRead.com Read the original post: Massive Ad Fraud Scheme Shut Down: 11 Million Phones Targeted...

A Sneaky Ad Scam Tore Through 11 Million Phones

Some 1,700 spoofed apps, 120 targeted publishers, 12 billion false ad requests per day—Vastflux is one of the biggest ad frauds ever discovered...

Information Disclosure

apachesuperset is vulnerable to Information Disclosure. A remote authenticated attacker with read access to a specific database can add subqueries to the WHERE and HAVING fields, resulting in references to tables on the same database that the attacker should not have access to. The perimeter to...

EulerOS Virtualization 2.9.0 : libldb (EulerOS-SA-2023-1225)

According to the versions of the libldb package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a...

CVE-2022-44870

A reflected cross-site scripting XSS vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module...

PT-2023-14563 · Maccms10 · Maccms10

Name of the Vulnerable Software and Affected Versions: maccms10 version 2022.1000.3032 Description: A reflected cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module...

maccms10 跨站脚本漏洞

maccms10 is magicblack open source PHP+MYSQL environment using a set of perfect and powerful rapid site-building system . maccms10 v2022.1000.3032 version of cross-site scripting XSS vulnerabilities. A cross-site scripting XSS vulnerability exists in maccms10 version v2022.1000.3032, which...

CVE-2022-44870

A reflected cross-site scripting XSS vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module...

CVE-2022-44870

A reflected cross-site scripting XSS vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module...

FBI warns of imposter ads in search results

The FBI has issued a public notice which includes advice to block adverts. Why? Lets take a look. The bogus advert tightrope Its no secret that rogue ads have been a particular plague on the Internet for as far back as we can remember. From irritating pop ups and spinning "Youve won a prize"...

CVE-2022-3614

In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation...