CVE-2024-8912 HTTP Request Smuggling in Looker

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: Looker Google Cloud core was found to be vulnerable. This issue has already been mitigated and our...

CVE-2024-8912

CVE-2024-8912 describes an HTTP Request Smuggling vulnerability in Looker. The issue affects customer-hosted Looker instances, which must be upgraded to the latest supported versions to be protected. Looker on Google Cloud core was reported as vulnerable but mitigated with no signs of exploitatio...

Zhejiang University Entersoft Customer Resource Management System 安全漏洞

Zhejiang University Entersoft Customer Resource Management System is a customer resource management system developed by the Zhejiang University team in China. A security vulnerability exists in the Zhejiang University Entersoft Customer Resource Management System due to an arbitrary file upload...

CVE-2024-46088: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2024 allows attackers to execute arbitrary code via uploading a crafted file...

PT-2024-31907 · Zhejiang University · Zhejiang University Entersoft Customer Resource Management System

Name of the Vulnerable Software and Affected Versions: Zhejiang University Entersoft Customer Resource Management System versions v2002 through v2024 Description: An arbitrary file upload vulnerability in the ProductAction.entphone interface allows attackers to execute arbitrary code via uploadin...

PT-2024-39313 · Looker · Looker

Name of the Vulnerable Software and Affected Versions: Looker versions prior to 23.12.123 Looker versions prior to 23.18.117 Looker versions prior to 24.0.92 Looker versions prior to 24.6.77 Looker versions prior to 24.8.66 Looker versions prior to 24.10.78 Looker versions prior to 24.12.56 Looke...

WordPress FULL Cliente plugin <= 3.1.22 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin FULL Customer versions = 3.1.22...

Introducing the Enhanced User Interface of the Qualys Enterprise TruRisk™ Platform

Launching the Enhanced User Interface The Qualys Product Team is excited to announce upcoming enhancements to the Qualys User Interface. These User Experience UX enhancements will make your platform experience faster, smoother, and more immersive. We continuously leverage insights from channels...

LVDA get unregistered randomly after reboot

The customer said their LVDA get unregistered randomly after reboot...

WordPress plugin Products, Order & Customers Export for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress FULL Customer Plugin <= 3.1.22 is vulnerable to Cross Site Scripting (XSS)

Software FULL Customer Type Plugin Vulnerable versions = 3.1.22 Fixed in 3.1.23 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9211 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 199342483259 Credits vgo0 Required...

Malicious code in customer-feedback-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf15dcf2318155d18aee75e77887bfe0709b51548def3d5e5906527670e25631 The OpenSSF Package Analysis project identified 'customer-feedback-widget' @ 1.5.8 npm as malicious. It is considered malicious because: - The...

MAL-2024-9112 Malicious code in customer-feedback-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf15dcf2318155d18aee75e77887bfe0709b51548def3d5e5906527670e25631 The OpenSSF Package Analysis project identified 'customer-feedback-widget' @ 1.5.8 npm as malicious. It is considered malicious because: - The...

How Wiz Meets CISA “Secure by Design” Objectives

An update on our commitments to customer security...

CVE-2024-8943: Authentication Bypass Using an Alternate Path or Channel

The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing...

Cyberattack on American Water Shuts Down Customer Portal, Halts Billing

American Water faces a cyberattack, disrupting its customer portal and billing operations. The company assures that water services…...

CVE-2024-8989: Improper Neutralization of Input During Web Page Generation

The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's starstestimonials shortcode in all versions up to, and including, 3.3.1 due to insufficient input sanitization and...

Our New Carbon Calculator Report Supports 400 Days of Data

The new Carbon Calculator is supported by the latest reporting API framework, improves performance, and allows customers to monitor up to 400 days of data...

Millions of Kia vehicles were vulnerable to remote attacks with just a license plate number

In June of 2024 security researchers uncovered a set of vulnerabilities in the Kia dealer portal that allowed them to remotely take over any Kia vehicle built after 2013—and all they needed was a license plate number. According to the researchers: "These attacks could be executed remotely on any...

CVE-2024-39319

aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions...