10304 matches found
Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!
Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the...
Security Bulletin: Vulnerability in Golang Go could affect IBM CICS TX Advanced [CVE-2023-24538]
Summary CVE-2023-24538 may affect IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-24538 DESCRIPTION: Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by not properly consider backticks as...
New Strain of Sotdas Malware Discovered
Introduction There are numerous malicious codes that are currently active on smart devices, such as Ddosf, Dofloo, Gafgyt, MrBlack, Persirai, Sotdas, Tsunami, Triddy, Mirai, Moose, and Satori, among others. These malicious codes and their variants can intrude into and control smart devices throug...
SUSE CVE-2022-42336
Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is coordinated at a core level, as the setting is shared between threads. Logic was introduced to keep track of how many threads...
Advanced Custom Fields for WordPress < 5.12.6 Cross-Site Scripting
The WordPress Advanced Custom Fields Plugin installed on the remote host is affected by a Cross-Site Scripting. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...
USN-6079-1 linux, linux-aws, linux-azure, linux-azure-5.19, linux-kvm, linux-lowlatency, linux-raspi vulnerabilities
It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. CVE-2022-27672 Ziming Zhang discovered that the VMware Virtual GPU DR...
hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch
A flaw was found in hw. This issue can cause AMD CPUs to transiently execute beyond unconditional direct branches...
hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch
A flaw was found in hw. This issue can cause AMD CPUs to transiently execute beyond unconditional direct branches...
amd: Return Address Predictor vulnerability leading to information disclosure
A side channel vulnerability was found in hw amd. Some AMD CPUs may allow an attacker to influence the return address prediction. This issue may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure...
WordPress Ricerca – advanced search Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)
Software Ricerca – advanced search Type Plugin Vulnerable versions = 1.0.15 Fixed in 1.0.16 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 32196aace89d Credits WordFence Required...
XSS Vulnerability in Popular WordPress Plugin Affects 2 Million Sites
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A Cross-Site scripting vulnerability has been discovered in an Advanced Custom Fields plugin for WordPress which has put 2 Million websites at risk. To receive real-time threat advisories, please...
CACTUS Ransomware Emerges as New Threat Targeting Large Enterprises
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary CACTUS is a new strain of ransomware that targets large commercial entities using a variety of tools and tactics to distribute the ransomware binary and maintain persistence within the environment while...
IBM MQ Information Disclosure (6985837)
The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 6985837 advisory. - When Advanced Message Security setup is enabled, there is an issue with IBM MQ tracing logic that means sensitive data can be captured while IBM MQ trace is running...
New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe
A previously undetected advanced persistent threat APT actor dubbed Red Stinger has been linked to attacks targeting Eastern Europe since 2020. "Military, transportation, and critical infrastructure were some of the entities being targeted, as well as some involved in the September East Ukraine...
VulnCheck KEV: CVE-2023-30777
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...
Security Bulletin: IBM MQ trace can inadvertently trace sensitive data (CVE-2023-28950)
Summary When Advanced Message Security setup is enabled, an issue was identified with IBM MQ tracing logic that meant sensitive data could be captured while IBM MQ trace was running. This data would be stored in plaintext within the IBM MQ trace files. Vulnerability Details CVEID:CVE-2023-28950...
New phishing-as-a-service tool “Greatness” already seen in the wild
A previously unreported phishing-as-a-service PaaS offering named "Greatness" has been used in several phishing campaigns since at least mid-2022. Greatness incorporates features seen in some of the most advanced PaaS offerings, such as multi-factor authentication MFA bypass, IP filtering and...
CVE-2023-30777
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...
