CVE-2023-43505

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to...

PT-2023-7189 · Microsoft · Sapi +1

Name of the Vulnerable Software and Affected Versions: Microsoft Speech Application Programming Interface SAPI affected versions not specified Description: The issue is related to insufficient access restrictions in the Speech API SAPI of Windows operating systems. It allows an attacker to elevat...

Microsoft Excel security vulnerabilities

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A security feature bypass vulnerability exists in Microsoft Excel, which can be exploited by an attacker to bypass security features and impact confidentiality, integrity, and availability...

PT-2023-6872

Name of the Vulnerable Software and Affected Versions COMOS All versions Description The issue is related to inadequate access controls in the COMOS application, specifically when making a connection to the SQLServer. This could allow a remote attacker to directly query the database, accessing...

PT-2023-6911 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insufficient access controls in the Windows Hyper-V hardware virtualization system, allowing an attacker to potentially elevate their privileges by sending...

Avrora Privilege Escalation

The vulnerability of the “Avora” operating system’s notification mechanism is related to deficiencies in permission control for applications that send notifications. Exploiting this vulnerability allows attackers to execute privileged requests to system components, which can lead to violations of...

Johnson Controls FRICK Quantum HD Unity System Controller Security Vulnerability

Johnson Controls FRICK Quantum HD Unity System Controller is an easy-to-use centralized control system from Johnson Controls, Inc. A security vulnerability exists in the Johnson Controls FRICK Quantum HD Unity System Controller that originates from allowing an unauthorized attacker to access...

CVE-2023-5544

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

Meta whistleblower says company has long ignored how it sexually endangers children

At a Senate hearing, a Meta whistleblower has revealed some shocking numbers around children’s experiences of its platforms. Arturo Béjar, a former engineering director at Meta, testified before the US Congress on Tuesday. Not only did he share his own daughters’ experience suffering harassment o...

Johnson Controls Quantum HD Unity

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable Remotely/Low attack complexity Vendor : Johnson Controls Inc. Equipment : Quantum HD Unity Vulnerability : Active Debug Code 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized user to...

Malware in airslate-controls

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8447 Malicious code in airslate-controls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 690f6f02456c41eb2e6abf2b8e2cac6a1480ef7107c64b0da3243848e4767365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in airslate-controls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 690f6f02456c41eb2e6abf2b8e2cac6a1480ef7107c64b0da3243848e4767365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.S. Treasury Sanctions Russian Money Launderer in Cybercrime Crackdown

The U.S. Department of the Treasury imposed sanctions against a 37-year-old Russian woman for taking part in the laundering of virtual currency for the country's elites and cybercriminal crews, including the Ryuk ransomware group. Ekaterina Zhdanova, per the department, is said to have facilitate...

CVE-2018-25093

A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The...

CVE-2018-25093

A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The...

CVE-2018-25093

A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The...

Rocky Linux 9 : device-mapper-multipath (RLSA-2022:8453)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8453 advisory. - A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjuncti...

Red Lion Controls Crimson Security Vulnerability

Red Lion Controls Crimson is a suite of HMI programming software from Red Lion Controls. A security vulnerability exists in the Red Lion Controls Crimson 3.2 Windows-based configuration tool that could allow an attacker with administrative access to define a new password for a user and download a...

CVE-2018-25092

A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to...