openSUSE: Security Advisory for kanidm (openSUSE-SU-2024:0095-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2024:0095-1 Security update for kanidm

This update for kanidm fixes the following issues: Update to version 1.1.0rc16git6.e51d0de: SECURITY: LOW Administrator triggered thread crash in oauth2 claim maps 2686 2686 return consent map to service account 2604...

Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions

The Mozilla Foundation Security Advisory describes this flaw as: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions...

Midnight Blizzard Attack Detection in Trellix Helix

Midnight Blizzard Attack Detection in Trellix Helix By Ian Shefferman · March 18, 2024 On January 25, 2024, Microsoft reported a breach of their systems by the Russian APT group Midnight Blizzard, also known as APT29 and Cozy Bear. The attackers performed a password spray, compromised a Microsoft...

Automakers Are Sharing Driver Data with Insurers without Consent

Kasmir Hill has the story: Modern cars are internet-enabled, allowing access to services like navigation, roadside assistance and car apps that drivers can connect to their vehicles to locate them or unlock them remotely. In recent years, automakers, including G.M., Honda, Kia and Hyundai, have...

The vulnerability of the process_delete function in the class-DNSMPD.php component of the GDPR/CCPA Cookie Consent plugin for WordPress’ content management system allows a hacker to perform a CSRF attack.

The vulnerability of the processdelete function in the class-DNSMPD.php component of the GDPR/CCPA Cookie Consent plugin for WordPress content management systems is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to execute a CSRF...

CVE-2024-23245

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent...

CVE-2024-23245

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent...

Code injection

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent...

CVE-2024-23245

CVE-2024-23245 affects macOS where third-party shortcuts could use a legacy Automator action to send events to apps without user consent. The issue is addressed by adding an additional prompt for user consent and is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, and macOS Ventura 13.6.5. Prac...

CVE-2024-23245

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent...

macOS 12.x < 12.7.4 Multiple Vulnerabilities (HT214083)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.7.4. It is, therefore, affected by multiple vulnerabilities: - This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4,...

Apple macOS Sonoma Security Vulnerability

Apple macOS Sonoma is a desktop operating system by Apple Inc. A security vulnerability exists in Apple macOS Sonoma version 14.4, which stems from a third-party shortcut that may use a legacy action in Automator to send events to an application without the user's consent...

PT-2024-19739 · Apple · Macos Monterey +4

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.4 macOS Monterey versions prior to 12.7.4 macOS Ventura versions prior to 13.6.5 Description: This issue was addressed by adding an additional prompt for user consent. Third-party shortcuts may use a legacy...

WordPress Complianz – GDPR/CCPA Cookie Consent Plugin <= 6.5.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Complianz – GDPR/CCPA Cookie Consent Type Plugin Vulnerable versions = 6.5.6 Fixed in 7.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1592 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 58711ad23413 Credits...

CVE-2024-1592

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. This is due to missing or incorrect nonce validation on the processdelete function in class-DNSMPD.php. This makes it possible for unauthenticated...

CVE-2024-1592

CVE-2024-1592 affects the Complianz – GDPR/CCPA Cookie Consent plugin for WordPress (up to version 6.5.6). The root cause is missing/incorrect nonce validation in process_delete() of class-DNSMPD.php, enabling CSRF without authentication. This allows unauthenticated attackers to delete GDPR data ...

CVE-2024-2045

The CVE-2024-2045 entry concerns Session version 1.17.5. Affected component: Local File Read via chat attachments, enabling retrieval of internal application files and public files from a user’s device without consent. This is a Local attack (LOCAL) requiring user interaction. Descriptions from m...

CVE-2024-2045 Session 1.17.5 - LFR via chat attachment

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...

The vulnerability in the cursor display implementation of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to obtain arbitrary permissions on a website without user consent.

The vulnerability in the cursor display implementation of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an incorrect limitation on the number of layers or frames that can be displayed. Exploiting this vulnerability allows a malicious actor to obtain arbitrary...