CVE-2023-0815

CVE-2023-0815 affects OpenNMS Meridian and Horizon (Jetty logging path). The issue enables potential leakage of usernames and passwords via Jetty log files when debug-level logging is active. Affected products are OpenNMS Meridian in multiple versions and Horizon, with remediation guidance to upg...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

CVE-2023-0104

Weintek EasyBuilder Pro is affected by CVE-2023-0104 (ZipSlip via decompiling a malicious project file). Affected: v6.07.01 and prior, v6.07.02.479 and prior, v6.08.01.349 and prior. Risk: enables attackers to gain control of a user’s machine or access sensitive data. Mitigation: upgrade to v6.07...

K52125139: NGINX Ingress Controller vulnerability CVE-2022-30535

Security Advisory Description An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. CVE-2022-30535 Impact This vulnerability may allow an authenticated attacker with network access to NGINX Ingress Controller ingress objects t...

K67090077: Apache HTTP Server vulnerability CVE-2022-22720

Security Advisory Description Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling. CVE-2022-22720 Impact Any authenticated user may exploit this vulnerability and cause a...

Hackers Stole GoDaddy Source Code in a Multi-Year Data Breach

By Deeba Ahmed The web hosting giant GoDaddy has been rattled by an almost two-year-long data breach that went undetected from 2020 to 2022. This is a post from HackRead.com Read the original post: Hackers Stole GoDaddy Source Code in a Multi-Year Data Breach...

Chip company loses $250m after ransomware hits supply chain

Applied Materials, one of the worlds leading suppliers of equipment, services, and software for the manufacture of semiconductors, has warned that its second-quarter sales are likely to be hurt to the tune of $250 million due to a cybersecurity attack at one of its suppliers. MKS Instruments Inc...

CVE-2022-34351

IBM QRadar SIEM vulnerable to information exposure (CVE-2022-34351) where a non-tenant user with a domain-specific security profile could view data from other domains in QRadar SIEM 7.4.x (7.4.0–7.4.3) and 7.5.x (7.5.0–7.5.0 Update Pack 3). The root cause is an information disclosure condition de...

SAS Airlines Hit by Cyber Attack

By Deeba Ahmed The cyber attack took place on Tuesday, February 14th evening, which forced the SAS Airlines' website and app to go offline and be inaccessible to passengers. This is a post from HackRead.com Read the original post: SAS Airlines Hit by Cyber Attack...

Lower Data Breach Insurance Costs with These Tips

The changing attack landscape has resulted in the hardening of the data breach insurance market. Gain insight into how implementing security controls can reduce the mean time to detect and control the costliness of an attack...

What to Look for When Buying a Security Camera (2023): Tips and Risks

Eufy's recent scandal shows it's not so much about the data breach but about how a company responds. Here are a few ways to shop smart...

SUSE CVE-2013-2449

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not...

SUSE CVE-2020-14698

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Orac...

Dell PowerScale OneFS Encryption Issue Vulnerability (CNVD-2023-12612)

Dell PowerScale OneFS is an operating system from Dell USA Inc. Dell PowerScale OneFS is vulnerable to an encryption issue that could be exploited by an attacker to cause a data breach...

French law to report cyberincidents within 3 days to become effective soon

The pressure on victims of cybercrime to notify authorities in a timely manner is increasing from many sides and for multiple reasons. On January 24, 2023 France passed a law Article L12-10-1 of the Insurance Code that victims of cybercrime are required to report the incident within 72 hours afte...

PT-2023-19035 · Controlbyweb · Control By Web X-400

Name of the Vulnerable Software and Affected Versions: Control By Web X-400 devices affected versions not specified Description: The issue concerns a cross-site scripting attack that could result in private and session information being transferred to the attacker. Recommendations: At the moment,...

Dell PowerScale OneFS 加密问题漏洞

Dell PowerScale OneFS is an operating system from Dell USA Inc. Dell PowerScale OneFS is vulnerable to an encryption issue that could be exploited by an attacker to cause a data breach...

Reddit Suffers Security Breach Exposing Internal Documents and Source Code

Popular social news aggregation platform Reddit has disclosed that it was the victim of a security incident that enabled unidentified threat actors to gain unauthorized access to internal documents, code, and some unspecified business systems. The company blamed it on a "sophisticated and...

A Hackers Pot of Gold: Your MSP's Data

A single ransomware attack on a New Zealand managed service provider MSP disrupted several of its clients' business operations overnight, most belonging to the healthcare sector. According to the country's privacy commissioner, "a cyber security incident involving a ransomware attack" in late...