PT-2024-21038

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.3.12 Liferay DXP 7.4 before update 9 Liferay DXP 7.3 service pack 3 Liferay DXP 7.2 fix pack 15 through 18 Description The issue allows remote attackers to redirect users to arbitrary external URLs via...

PT-2024-21494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the net/sched: act mirred component in the Linux kernel. When redirecting the skb and tcf mirred forward has not been called, the core needs to be told to drop th...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

PT-2024-12856 · Westermo · Westermo Lynx

Name of the Vulnerable Software and Affected Versions: Westermo Lynx affected versions not specified Description: An attacker with access to the Westermo Lynx web application could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the forward.0.domain parameter...

Westermo Lynx 206-F2G Cross-Site Scripting Vulnerability

The Westermo Lynx 206-F2G is a Layer 3 industrial Ethernet switch from Westermo, Sweden, powered by the Westermo WeOS network operating system. A security vulnerability exists in the Westermo Lynx 206-F2G. The vulnerability can be exploited to introduce arbitrary JavaScript by injecting a...

CVE-2023-40143: Improper Neutralization of Input During Web Page Generation

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

TOTOLINK A3300R 安全漏洞

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the enable parameter of the setPortForwardRules method failing to correctly filter construct command specia...

CVE-2023-30970

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system...

Path traversal

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system...

CVE-2023-30970 Gotham table and Forward App Path traversal

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system...

CVE-2023-30970

CVE-2023-30970 affects Gotham Table service and Forward App. The issue is a Path traversal vulnerability that allows an authenticated user to read arbitrary files on the file system. Affected component is the file-path handling within Gotham Table/Forward App (no specific version or patch details...

CVE-2023-30970 Gotham table and Forward App Path traversal

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system...

CVE-2023-30970: Absolute Path Traversal

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system...

PT-2024-12248

Name of the Vulnerable Software and Affected Versions Gotham Table service affected versions not specified Forward App affected versions not specified Description The issue allows an authenticated user to read arbitrary files on the file system due to a Path traversal problem. Recommendations For...

CVE-2023-36842

An Improper Check for Unusual or Exceptional Conditions vulnerability in Juniper DHCP Daemon jdhcpd of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause the jdhcpd to consume all the CPU cycles resulting in a Denial of Service DoS. On Junos OS devices with...

Rapid7’s Data-Centric Approach to AI in Belfast

Authored by Stuart Millar and Ryan Wilson. Rapid7 has expanded significantly in Belfast since establishing a presence back in 2014, resulting in the company's largest R&D hub outside the US with over 350 people spread across eight floors in our Chichester Street office. There is a wide range of...

New Bluetooth Attack

New attack breaks forward secrecy in Bluetooth. Three news articles: BLUFFS is a series of exploits targeting Bluetooth, aiming to break Bluetooth sessions forward and future secrecy, compromising the confidentiality of past and future communications between devices. This is achieved by exploitin...

Web Security Expands into Secure Service Edge (SSE)

Trend has been securing web access for over a decade with forward-looking innovation and a global footprint to support our customer’s security strategy. We are committed to our customers’ journey of transforming their current security posture, aligning with Zero Trust principles, and embracing a...

Forward Momentum: Key Learnings From Trend Micro’s Security Predictions for 2024

In this blog entry, we discuss predictions from Trend Micro’s team of security experts about the drivers of change that will figure prominently in 2024...

New BLUFFS Bluetooth Attack Expose Devices to Adversary-in-the-Middle Attacks

New research has unearthed multiple novel attacks that break Bluetooth Classic's forward secrecy and future secrecy guarantees, resulting in adversary-in-the-middle AitM scenarios between two already connected peers. The issues, collectively named BLUFFS, impact Bluetooth Core Specification 4.2...