Oracle Primavera Unifier (Jul 2024 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Integration Apache James MIME4J. Supported versio...

Oracle Primavera Gateway (Jul 2024 CPU)

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin Spring Framework. Supported versions that a...

Navigating Insider Risks: Are your Employees Enabling External Threats?

Attacks on your network are often meticulously planned operations launched by sophisticated threats. Sometimes your technical fortifications provide a formidable challenge, and the attack requires assistance from the inside to succeed. For example, in 2022, the FBI issued a warning1 that SIM swap...

CVE-2024-39541

An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. When conflicting information IP or ISO addresses about a node is added t...

New Poco RAT Targets Spanish-Speaking Victims in Phishing Campaign

Spanish language victims are the target of an email phishing campaign that delivers a new remote access trojan RAT called Poco RAT since at least February 2024. The attacks primarily single out mining, manufacturing, hospitality, and utilities sectors, according to cybersecurity company Cofense...

Siemens Engineering Platforms Catalog Configuration File Deserialization Vulnerability

Totally Integrated Automation Portal TIA Portal is PC software that offers the complete range of Siemens digital automation services, from digital planning and integrated engineering to transparent operation. A deserialization vulnerability in the Siemens Engineering Platforms catalog configurati...

PT-2024-28523 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions 22.4 through 22.4R3-S1 Junos OS versions 23.2 through 23.2R2 Junos OS versions 23.4 through 23.4R1-S1, 23.4R2 Junos OS Evolved versions 22.4-EVO through 22.4R3-S2-EVO Junos OS Evolved versions 23.2-EVO through 23.2R2-EVO Jun...

Fortinet Fortigate XSS vulnerability in SSL VPN web UI (FG-IR-23-485)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-485 advisory. - The vulnerability exists due to insufficient sanitization of user-supplied data in SSL VPN web UI. A remote attacker can...

Siemens Simcenter Femap Out-of-Bounds Read Vulnerability

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap suffers from an out-of-bounds read vulnerability that can be...

Siemens Simcenter Femap Out-of-Bounds Write Vulnerability (CNVD-2024-31241)

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. An out-of-bounds write vulnerability exists in Siemens Simcenter Femap, which can be...

Vulnerabilities fixed in Siemens Products

Siemens has fixed vulnerabilities in various products such as Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC and the Engineering Platforms for various systems. The vulnerabilities potentially enable a malicious person to carry out attacks that can lead to the following categories of damage: -...

Reverse-Engineering Ticketmaster’s Barcode System

Interesting: By reverse-engineering how Ticketmaster and AXS actually make their electronic tickets, scalpers have essentially figured out how to regenerate specific, genuine tickets that they have legally purchased from scratch onto infrastructure that they control. In doing so, they are removin...

Siemens SIMATIC WinCC和SIMATIC STEP 代码问题漏洞

Totally Integrated Automation Portal TIA Portal is PC software that offers the complete range of Siemens digital automation services, from digital planning and integrated engineering to transparent operation. A deserialization vulnerability in the Siemens Engineering Platforms catalog configurati...

Experts Warn of Mekotio Banking Trojan Targeting Latin American Countries

Financial institutions in Latin America are being threatened by a banking trojan called Mekotio aka Melcoz. That's according to findings from Trend Micro, which said it recently observed a surge in cyber attacks distributing the Windows malware. Mekotio, known to be actively put to use since 2015...

CVE-2024-31223 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

Fides is an open-source privacy engineering platform, and SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address,...

CVE-2024-38537

Fides is an open-source privacy engineering platform. fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard...

CVE-2024-38537 Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

Fides is an open-source privacy engineering platform. fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard...

CVE-2024-38537 Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

Fides is an open-source privacy engineering platform. fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard...

CVE-2024-38537 Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

Fides is an open-source privacy engineering platform. fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard...

CapraRAT Spyware Disguised as Popular Apps Threatens Android Users

The threat actor known as Transparent Tribe has continued to unleash malware-laced Android apps as part of a social engineering campaign to target individuals of interest. "These APKs continue the group's trend of embedding spyware into curated video browsing applications, with a new expansion...