14513 matches found
WordPress Digital River Global Commerce Plugin <= 2.0.2 is vulnerable to Backdoor
Software Digital River Global Commerce Type Plugin Vulnerable versions = 2.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 094cc90dcba0 Credits Sansec.io Required privilege Unauthenticated Publishe...
Prudential Financial data breach impacts 2.5 million people, not 36,000 as first thought
In February 2024, Prudential Financial reported it had fallen victim to a ransomware attack. The attack was discovered one day after it started, but not before some 2.5 million people had been impacted by the resulting data breach. As one of the largest insurance companies in the US, Prudential...
ignite.digital Cross Site Scripting vulnerability OBB-3940143
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Meta's 'Pay or Consent' Approach Faces E.U. Competition Rules Scrutiny
Meta's decision to offer an ad-free subscription in the European Union E.U. has faced a new setback after regulators accused the social media behemoth of breaching the bloc's competition rules by forcing users to choose between seeing ads or paying to avoid them. The European Commission said the...
ALPINE-CVE-2024-34703
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameter...
Security Analysis of the EU’s Digital Wallet
A group of cryptographers have analyzed the eiDAS 2.0 regulation electronic identification and trust services that defines the new EU Digital Identity Wallet...
SDG Technologies PnPSCADA
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : SDG Technologies Equipment : PnPSCADA Vulnerability : Missing Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to attach various...
PT-2024-25994 · Apache · Apache Xml Security For C++
Name of the Vulnerable Software and Affected Versions: Apache XML Security for C++ versions 2.0.4 and earlier Description: The issue is related to the implementation of the XML Signature Syntax and Processing XMLDsig specification, which lacks protection against an SSRF payload in a KeyInfo...
CVE-2024-38364
CVE-2024-38364 (DSpace XSS) affects DSpace 7.0–7.6.1. When a user downloads an HTML, XML, or JavaScript Bitstream, the browser may execute embedded JavaScript, enabling a cross-site scripting (XSS) vulnerability. The root cause, as described in the public materials, is insufficient/unsafe handlin...
Stolen Singaporean Identities Sold on Dark Web Starting at $8
Singapore citizens, beware! Cybercriminals are targeting your digital identities and KYC data, starting at just $8, putting users at risk of exploitation. Learn how to protect your data, finances, and reputation with strong passwords, multi-factor authentication, and smart online habits...
Malicious code in wfui-digital-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a742de3dd0f1ab29c611830886c1fc401f3d3bd675927d39c27707f2f50b38f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-3950 Malicious code in wfui-digital-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a742de3dd0f1ab29c611830886c1fc401f3d3bd675927d39c27707f2f50b38f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-2907 Malicious code in qatar-digital-webkit (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in qatar-digital-webkit (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @caesars-digital/ui-toolkit (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-22168 Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
A Cross-Site Scripting XSS vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry...
Multiple Western Digital Products Cross-Site Scripting Vulnerability
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in multiple Western Digital products that stems from the presence of a cross-site scripting XSS vulnerability that could allow an attacker to redirect a user to a crafted domain and...
SUSE CVE-2024-38551
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Assign dummy when codec not specified for a DAI link MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the cod...
