CVE-2024-53274 GHSL-2024-111: Reflected XSS in /home in habitica

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The register function in home.vue containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious redirectTo parameter...

CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...

CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...

Krispy Kreme Cyber Attack Disrupted Online Ordering in the US

SUMMARY Popular doughnut chain Krispy Kreme has become the latest victim of a cyber attack. The incident, which…...

Researchers Uncover Espionage Tactics of China-Based APT Groups in Southeast Asia

A suspected China-based threat actor has been linked to a series of cyber attacks targeting high-profile organizations in Southeast Asia since at least October 2023. The espionage campaign targeted organizations in various sectors spanning government ministries in two different countries, an air...

CVE-2024-55550

creationtimestamp| type| source ---|---|--- 2024-12-10 20:49:25+00:00| seen| https://t.me/cvedetector/12538 2025-01-07 15:54:44+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113787881639134332 2025-01-07 16:19:29+00:00| seen|...

CVE-2024-490646

creationtimestamp| type| source ---|---|--- 2024-12-10 18:33:29+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2024-0471...

Hackers Weaponize Visual Studio Code Remote Tunnels for Cyber Espionage

A suspected China-nexus cyber espionage group has been attributed to an attacks targeting large business-to-business IT service providers in Southern Europe as part of a campaign codenamed Operation Digital Eye. The intrusions took place from late June to mid-July 2024, cybersecurity companies...

Horner Automation Cscape

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

Siemens CPCI85 Central Processing/Communication 

SUMMARY The SICAM A8000 CP-8031 and CP-8050 devices are affected by a vulnerability that could allow an attacker with physical access to the device to decrypt the firmware. Siemens has released new firmware and hardware versions for the affected products and recommends to update to the latest...

Learn How Experts Secure Privileged Accounts—Proven PAS Strategies Webinar

Cybercriminals know that privileged accounts are the keys to your kingdom. One compromised account can lead to stolen data, disrupted operations, and massive business losses. Even top organizations struggle to secure privileged accounts. Why? Traditional Privileged Access Management PAM solutions...

More_eggs MaaS Expands Operations with RevC2 Backdoor and Venom Loader

The threat actors behind the Moreeggs malware have been linked to two new malware families, indicating an expansion of its malware-as-a-service MaaS operation. This includes a novel information-stealing backdoor called RevC2 and a loader codenamed Venom Loader, both of which are deployed using...

Exploit for CVE-2024-54679

CVE-2024-54679 CVE-2024-54679 - CyberPanel aka Cyber Panel D...

PT-2024-9986 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Linux before build 39185 Description: The issue is related to the use of a weak algorithm for signing RPM packages in the Acronis Cyber Protect Cloud Agent for Linux. This weakness can potentially allow an...

CVE-2024-48846

creationtimestamp| type| source ---|---|--- 2024-12-05 13:07:56+00:00| seen| https://infosec.exchange/users/cve/statuses/113600369539008057 2025-01-07 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01 2025-04-17 21:02:36+00:00| seen|...

Hackers Target Uyghurs and Tibetans with MOONSHINE Exploit and DarkNimbus Backdoor

A previously undocumented threat activity cluster dubbed Earth Minotaur is leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs. "Earth Minotaur uses MOONSHINE to delive...

ASD’s ACSC, CISA, and US and International Partners Release Guidance on Choosing Secure and Verifiable Technologies

Today, CISA—in partnership with the Australian Signals Directorate Australian Cyber Security Centre ASD ACSC, and other international partners—released updates to a Secure by Design Alert, Choosing Secure and Verifiable Technologieslink is external. Partners that provided recommendations in this...

She Escaped an Abusive Marriage—Now She Helps Women Battle Cyber Harassment

Inspired by her own experience of abuse, Nighat Dad fights for women’s social and digital rights in Pakistan and beyond...

AutomationDirect C-More EA9 Programming Software

RISK EVALUATION Successful exploitation of these vulnerabilities could result in memory corruption; a buffer overflow condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...

Joint Advisory Warns of PRC-Backed Cyber Espionage Targeting Telecom Networks

A joint advisory issued by Australia, Canada, New Zealand, and the U.S. has warned of a broad cyber espionage campaign undertaken by People's Republic of China PRC-affiliated threat actors targeting telecommunications providers. "Identified exploitations or compromises associated with these threa...