keycloak: XSS via assertion consumer service URL in SAML POST-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations

The U.S. Federal Trade Commission FTC has ordered mental telehealth company Cerebral from using or disclosing personal medical data for advertising purposes. It has also been fined more than $7 million over charges that it revealed users' sensitive personal health information and other data to...

PT-2024-5147

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS,...

U.S. Cyber Safety Board Slams Microsoft Over Breach by China-Based Hackers

The U.S. Cyber Safety Review Board CSRB has criticized Microsoft for a series of security lapses that led to the breach of nearly two dozen companies across Europe and the U.S. by a China-based nation-state group called Storm-0558 last year. The findings, released by the Department of Homeland...

CVE-2024-2963: Improper Neutralization of Input During Web Page Generation

The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2024-22943 · WordPress · Pocket News Generator

Name of the Vulnerable Software and Affected Versions: The Pocket News Generator plugin for WordPress versions up to, and including, 0.2.0 Description: The issue is related to Stored Cross-Site Scripting via admin settings, specifically Consumer Key and Access Token, due to insufficient input...

Disturbing robocaller fined $9.9 million

A federal court in Montana has fined a man $9.9 million after he was found responsible for causing thousands of unlawful and malicious spoofed robocalls. Sometimes there is good news. Well, for almost everybody except for the robocaller who was found guilty of unlawful robocalls to people in stat...

Canada revisits decision to ban Flipper Zero

In February 2024 the Canadian government announced plans to ban the sale of the Flipper Zero, mainly because of its reported use to steal cars. The Flipper Zero is a portable device that can be used in penetration testing with a focus on wireless devices and access control systems. If that doesnt...

keycloak: XSS via assertion consumer service URL in SAML POST-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

The vulnerability of the Skype for Consumer instant messaging program, related to insufficient input data validation, allows a hacker to execute arbitrary code.

The vulnerability of the Skype for Consumer instant messaging program is related to insufficient validation of entered data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Unspecified Vulnerability in Apache Pulsar (CNVD-2024-26184)

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenant, persistent storage, multi-machine room cross-region data replication,...

CVE-2024-21411

Skype for Consumer Remote Code Execution Vulnerability...

CVE-2024-21411

Skype for Consumer Remote Code Execution Vulnerability...

Remote code execution

Skype for Consumer Remote Code Execution Vulnerability...

CVE-2024-21411 Skype for Consumer Remote Code Execution Vulnerability

...

CVE-2024-21411 Skype for Consumer Remote Code Execution Vulnerability

...

CVE-2024-21411

CVE-2024-21411 — Skype for Consumer RCE : The vulnerability is caused by insufficient input validation in Skype for Consumer, allowing a remote attacker to execute arbitrary code. Exploitation requires user interaction (e.g., opening a malicious page/rogue link). The CVSSv3.1 base score is 8.8 (H...

Malicious code in pod-consumer-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790a64f75aa99c50c9bf2260bbd26b07020cf459a31f214e1a6a6c1336b62c30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1086 Malicious code in pod-consumer-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790a64f75aa99c50c9bf2260bbd26b07020cf459a31f214e1a6a6c1336b62c30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in pod-consumer-backend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...