CVE-2023-40191

Reflected cross-site scripting XSS vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected in...

CVE-2023-40191: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting XSS vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected in...

LockBit Ransomware's Darknet Domains Seized in Global Law Enforcement Raid

Update: The U.K. National Crime Agency NCA has confirmed the takedown of LockBit infrastructure. Read here for more details. An international law enforcement operation has led to the seizure of multiple darknet domains operated by LockBit, one of the most prolific ransomware groups, marking the...

PT-2024-12863

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.44 through 7.4.3.97 Liferay DXP 2023.Q3 before patch 6 Liferay DXP versions 7.4 update 44 through 92 Description A reflected cross-site scripting XSS issue exists in the instance settings for Accounts, allowing...

LockBit Ransomware Gang Domains Seized in Global Operation

By Waqas All known dark web domains operated by the notorious LockBit Ransomware Gang are displaying a law enforcement seizure notice as part of "Operation Cronos." This is a post from HackRead.com Read the original post: LockBit Ransomware Gang Domains Seized in Global Operation...

USN-6641-1 curl vulnerability

Harry Sintonen discovered that curl incorrectly handled mixed case cookie domains. A remote attacker could possibly use this issue to set cookies that get sent to different and unrelated sites and domains...

USN-6641-1: curl vulnerability

Harry Sintonen discovered that curl incorrectly handled mixed case cookie domains. A remote attacker could possibly use this issue to set cookies that get sent to different and unrelated sites and domains...

Remote Monitoring & Management software used in phishing attacks

Remote Monitoring & Management RMM software, including popular tools like AnyDesk, Atera, and Splashtop, are invaluable for IT administrators today, streamlining tasks and ensuring network integrity from afar. However, these same tools have caught the eye of cybercriminals, who exploit them to...

Description of Security Update 12 for Exchange Server 2016: March 12, 2024 (KB5036386)

None None...

Over 800 Phony “Temu” Domains Lure Shoppers into Credential Theft

By Deeba Ahmed Blank Image, Fake Link: Unraveling the Temu Phishing Scam Targeting Senior Shoppers! This is a post from HackRead.com Read the original post: Over 800 Phony "Temu" Domains Lure Shoppers into Credential Theft...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2024-1172)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more origins than what is otherwise allowed o...

CVE-2023-45213 Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains

A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device...

Open Redirect

pyloadng is vulnerable to Open Redirect. The vulnerability is due to the issafeurl and getredirecturl functions within helpers.py improperly validating redirect URLs, which allows an attacker to redirect users to arbitrary domains after login...

Amazon Linux 2023 : systemd, systemd-boot-unsigned, systemd-container (ALAS2023-2024-509)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-509 advisory. systemd-resolved accepts records of DNSSEC-signed domains even when they have no signature, allowing man- in-the-middles or the upstream DNS resolver to manipulate records. CVE-2023-7008 Tenable has...

CVE-2023-50940

IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 275130...

PT-2024-6579 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of Cross-Origin Resource Sharing CORS in IBM PowerSC, which could allow an attacker to carry out privileged actions and retrieve sensitive information. This is...

BucketLoot - An Automated S3-compatible Bucket Inspector

BucketLoot is an automated S3-compatible Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text. The tool can scan for bucke...

Fedora 38 : systemd (2024-c79658eedf)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c79658eedf advisory. - A bunch of fixes for various components: systemd, systemctl, hostnamectl, bootctl, systemd-networkd, systemd-network-generator, systemd-analyze,...

Security Operations (SecOps)

Understanding the Basics of Security Operations SecOps SecOps represents the blending of cybersecurity proficiency with operational domains, forming a powerful bulwark. Its primary mission lies in safeguarding the fundamental data assets and technological infrastructures of an organization. More...

RHEL 9 : curl (RHSA-2024:0434)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0434 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...