CVE-2023-41703

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avo...

PT-2024-12962 · Open Xchange Gmbh +1 · Ox App Suite +2

Name of the Vulnerable Software and Affected Versions: No specific software name or affected versions are mentioned in the provided descriptions. Description: The issue concerns the processing of CID references in E-Mail, which can be exploited to inject malicious script code that bypasses the...

PT-2024-12963 · Unknown · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite affected versions not specified Description: The issue arises from the processing of user-defined DAV user-agent strings not being limited, which could lead to a high processing load and reduce the availability of OX App Suite. T...

PT-2024-12964 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite affected versions not specified Description: The issue concerns the processing time of drive search expressions, which is now monitored, and the related request is terminated if a resource threshold is reached. This could reduce...

PT-2024-12961 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue arises from the improper sanitization of User ID references at mentions in document comments, allowing script code to be injected into a user's session when working with a...

Raspberry Robin Malware Upgrades with Discord Spread and New Exploits

The operators of Raspberry Robin are now using two new one-day exploits to achieve local privilege escalation, even as the malware continues to be refined and improved to make it stealthier than before. This means that "Raspberry Robin has access to an exploit seller or its authors develop the...

QNAP QTS / QuTS hero Multiple Vulnerabilities in QTS, QuTS hero, and QuTScloud (QSA-24-02)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-24-02 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

CISA Releases Two Industrial Control Systems Advisories

CISA released two Industrial Control Systems ICS advisories on February 8, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-039-01 Qolsys IQ Panel 4, IQ4 HUB ICSA-23-082-06 ProPump and Controls Osprey Pump...

Known ransomware attacks up 68% in 2023

Today, Malwarebytes released its 2024 State of Malware report, detailing six cyberthreats that resource-constrained IT teams should pay attention to in 2024. Top of the list is "Big Game" ransomware, the most serious cyberthreat to businesses all around the world. Big game attacks extort vast...

CISA Releases Two Industrial Control Systems Advisories

CISA released two Industrial Control Systems ICS advisories on February 6, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-037-01 HID Global Encoders ICSA-24-037-02 HID Global Reader Configuration Cards CISA...

Pegasus Spyware Targeted iPhones of Journalists and Activists in Jordan

The iPhones belonging to nearly three dozen journalists, activists, human rights lawyers, and civil society members in Jordan have been targeted with NSO Group's Pegasus spyware, according to joint findings from Access Now and the Citizen Lab. Nine of the 35 individuals have been publicly confirm...

Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal

...

Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities

Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices. This includes custom web shells such as BUSHWALK,...

Exploit for Out-of-bounds Write in Google Chrome

From: https://github.com/github/securitylab/tree/main/SecurityEx...

KLA63619 PE vulnerability in Microsoft Browser

An elevation of privilege vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2024-21388 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Edge CVE list CVE-2024-21388 high KB...

WordPress 6.0 < 6.4.3

WordPress versions 6.0 6.4.3 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-6-4-3-maintenance-and-security-release. include'compat.inc'; if description...

Fedora 39 : dnsmasq (2024-b359bbdf87)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b359bbdf87 advisory. Change initial configuration to use local-service=host for initial listening on localhost. It auto- disables itself as soon as other explicit interface or...

Introducing the Wallarm 2024 API ThreatStatsTM Report

The Wallarm Security Research team is pleased to share the latest version of our API ThreatStats report. This report serves as a key resource for API, Application security practitioners. It emphasizes the need for a proactive stance in API security, advocating for continuous monitoring, regular...

PT-2024-11007 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel versions 8.x Description: The issue is related to an Access Control problem. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

Fedora 38 : vorbis-tools (2024-5f8da7c1f1)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5f8da7c1f1 advisory. Security fix for CVE-2023-43361 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...