The Top 10 AI Security Risks Every Business Should Know

With every week bringing news of another AI advance, it’s becoming increasingly important for organizations to understand the risks before adopting AI tools. This look at 10 key areas of concern identified by the Open Worldwide Application Security Project OWASP flags risks enterprises should kee...

CVE-2023-41919

Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access...

CVE-2023-41919

CVE-2023-41919 concerns hard-coded credentials in Kiloview P1/P2 devices. Connected sources describe vulnerabilities in the devices’ firmware that allow authentication bypass and potential full system takeover, with no encryption on the configuration Web interface and possible remote code/privile...

Polyfill Detected

The polyfill.js file is a popular open-source library to ensure old browsers compatibility when evaluating JavaScript code. Starting February 2024, the domain polyfill.io and the related GitHub account have been purchased by a malicious threat actor to inject malwares in all web applications...

Decoding OWASP – A Security Engineer’s Roadmap to Application Security

In a time where over 60% of data breaches are linked to software vulnerabilities and a single overlooked software vulnerability can expose sensitive data, the imperative of robust application security cannot be overstated. The 2023 IBM Security Cost of a Data Breach Report highlights that...

Practical Guidance For Securing Your Software Supply Chain

The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who...

How to Restrict Access to NetScaler Owned IP Addresses Only from the Management Applications

Any application running on the NetScaler appliance's operating system is exposed to the world through NetScaler-owned IP addresses. This exposure may result in network attacks, which can negatively impact the performance of the NetScaler appliance. Note : You can block the non-management...

CVE-2024-4498

CVE-2024-4498 affects parisneo/lollms-webui (versions v9.7 to latest). The flaw is in the /apply_settings function, where insufficient input validation on the parameter discussion_db_name enables path traversal and Remote File Inclusion (RFI). The issue is worsened by a reported bypass of input f...

MAL-2024-6647 Malicious code in application-module (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3084 Malicious code in teams-web-part-application (npm)

--- -= Per source details. Do not edit below this line.=-...

actionlogement.fr Cross Site Scripting vulnerability OBB-3937477

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-6007

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate t...

CVE-2024-6007 Netentsec NS-ASG Application Security Gateway deleteiscgwrouteconf.php sql injection

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate t...

Netentsec NS-ASG Application Security Gateway SQL Injection Vulnerability

NetentSec NS-ASG Application Security Gateway is an application security gateway from China NetentSec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from the parameter messagecontent in the file...

PT-2024-37310

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical issue has been found in the Netentsec NS-ASG Application Security Gateway. This issue affects the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php and allows...

OPENSUSE-SU-2024:13497-1 krb5-appl-clients-1.0.3-1.1 on GA media

These are all security issues fixed in the krb5-appl-clients-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-6007: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate t...

CVE-2024-34690 Missing Authorization check in SAP Student Life Cycle Management (SLcM)

SAP Student Life Cycle Management SLcM fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted,...

CVE-2024-5773 Netentsec NS-ASG Application Security Gateway deletemacbind.php sql injection

A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/firewall/deletemacbind.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to launch the...

CVE-2024-5772 Netentsec NS-ASG Application Security Gateway deleteiscuser.php sql injection

A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack ma...