PT-2023-28158 · Freepbx · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX affected versions not specified Description: A security issue has been identified in Endpoint Manager and Rest Apps of FreePBX. The estimated number of potentially affected devices worldwide is not specified. There is no information...

Design/Logic Flaw

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

[SECURITY] Fedora 39 Update: moby-engine-24.0.5-1.fc39

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between - and they don'...

Fake Signal and Telegram Apps in the Google Play Store

Google removed fake Signal and Telegram apps from its Play store. An app with the name Signal Plus Messenger was available on Play for nine months and had been downloaded from Play roughly 100 times before Google took it down last April after being tipped off by security firm ESET. It was also...

Microsoft Security Update Validation Report September 2023

Microsoft’s September 2023 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues September still be found upon implementation. Follow best practices for testing and installing...

Update Citrix Secure Access and SSO apps to 23.09.1 before upgrading OS on Mac and iOS devices

In general we have seen two issues with the beta releases from Apple for Sonoma and iOS 17. So if the versions prior to 23.09.1 of the Citrix Secure Access and SSO apps are used with MacOS Sonoma and iOS/iPadOS 17, then the following issues would be seen: Apps will not be able to generate the log...

Design/Logic Flaw

The OData service of the S4 HANA Manage checkbook apps - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call...

CVE-2023-41368 Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)

The OData service of the S4 HANA Manage checkbook apps - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call...

CVE-2023-41368

CVE-2023-41368 affects SAP S/4HANA’s Manage checkbook apps OData service (S/4HANA) versions 102–107. The vulnerability allows an attacker to change the checkbook name by simulating an update OData call. The CVE note indicates the issue is an Insecure Direct Object Reference style exposure, with n...

CVE-2023-41368: Authorization Bypass Through User-Controlled Key

The OData service of the S4 HANA Manage checkbook apps - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call...

KLA60570 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in 3D Builder can be exploited remotely to execute arbitrary code. 2. A remote...

SAP S4 HANA Security Breach

SAP S4 HANA is a software for improving database efficiency from SAP, Germany. A security vulnerability exists in SAP S4 HANA Manage checkbook apps versions 102, 103, 104, 105, 106, and 107 that originates from a vulnerability that allows an attacker to change the checkbook name by emulating an...

Millions Infected by Spyware Hidden in Fake Telegram Apps on Google Play

Spyware masquerading as modified versions of Telegram have been spotted in the Google Play Store that's designed to harvest sensitive information from compromised Android devices. According to Kaspersky security researcher Igor Golovin, the apps come with nefarious features to capture and...

[SECURITY] Fedora 38 Update: python-jupyter-server-2.1.0-2.fc38

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila...

CVE-2023-40306

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity...

Input validation

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity...

CVE-2023-40306 URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity...

CVE-2023-40306

CVE-2023-40306 affects SAP S/4HANA Manage Catalog Items and Cross-Catalog searches in the Fiori apps. The root cause is insufficient URL validation, enabling an open-redirect where an attacker can redirect users to a malicious site. The vulnerability is rated CVSS v3.1 Base Score 6.1 (Medium) wit...

CVE-2023-40306: URL Redirection to Untrusted Site

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity...