Cross-site Scripting (XSS)

Overview NuGetGallery is a Core support library for NuGet Gallery Frontend and Backend. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization of autolinks. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...

Cybersecurity Jobs: The Demand Grows, but Supply Falls Short, Report

U.S. cybersecurity jobs face a talent gap, per the CyberSeek report, with only enough workers for 85% of…...

RHEL 4 : glibc (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - glibc: posixspawnfileactionsaddopen fails to copy the path argument CVE-2014-4043 - glibc: heap/stack gap...

UBUNTU-CVE-2024-36024

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable idle reallow as part of command/gpint execution Why Workaroud for a race condition where DMCUB is in the process of committing to IPS1 during the handshake causing us to miss the transition into IPS2 and...

PT-2024-4058 · Totolink · Totolink Lr350

Name of the Vulnerable Software and Affected Versions: TOTOLINK LR350 version V9.3.5u.6369 B20220309 Description: The issue is related to the NTPSyncWithHost function in the TOTOLINK LR350 router's firmware, which lacks input validation. This can be exploited by a remote attacker to execute...

PT-2024-24136 · WordPress · Post Blocks +5

Name of the Vulnerable Software and Affected Versions: Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress versions up to, and including, 2.2.80 Description: The issue is related to Stored Cross-Site Scripting due to insufficient...

Rapid7 Signs 100% Talent Compact with Boston Women’s Workforce Council

The effort aims to help close gender and racial pay gaps Rapid7 is proud to announce their signing of the 100% Talent Compact through the Boston Women’s Workforce Council BWWC. The Talent Compact is a collective effort among the Boston Mayor and local employers to close the gender and racial wage...

CVE-2023-51557

Foxit PDF Reader AcroForm Doc Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a maliciou...

PT-2024-21489 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability has been resolved in the Linux kernel, specifically in the drm/i915/dsc component. The issue arises from a macro that calculates the DSCC /DSCA PPS register address,...

Kofax Power PDF 安全漏洞

Kofax Power PDF is a professional PDF editing and management software from Kofax. A security vulnerability exists in Kofax Power PDF that stems from a specific flaw in the parsing of PDF files that lacks proper validation of user-supplied data, allowing a remote attacker to execute arbitrary code...

Crafting and Communicating Your Cybersecurity Strategy for Board Buy-In

In an era where digital transformation drives business across sectors, cybersecurity has transcended its traditional operational role to become a cornerstone of corporate strategy and risk management. This evolution demands a shift in how cybersecurity leaders—particularly Chief Information...

NIST NVD Halt Leaves Thousands of Vulnerabilities Untagged

By Deeba Ahmed 40% of 2024 CVEs Missing Key Info: NVD Data Gap Raises Security Risks! This is a post from HackRead.com Read the original post: NIST NVD Halt Leaves Thousands of Vulnerabilities Untagged...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips that stems from a lack of boundary checking in the battery module, which could lead to privilege escalation...

CISA Releases Resource Guide for University Cybersecurity Clinics

Today, CISA released a Resource Guide for Cybersecurity Clinics to outline ways CISA can partner with and support cybersecurity clinics and their clients. University cybersecurity clinics train students from diverse backgrounds and academic expertise to strengthen the digital defenses of...

Improving Security with Wallarm’s NIST CSF 2.0 Dashboard

Ensuring the security of web applications and APIs is more critical than ever. With threats becoming increasingly prevalent and sophisticated, organizations need to employ comprehensive security measures to protect their digital assets. The NIST Cybersecurity Framework CSF 2.0 stands at the...

PX4 Drone Autopilot Security Vulnerability

PX4 Drone Autopilot is a PX4 Drone Autopilot for Drones open source. A security vulnerability exists in PX4 Drone Autopilot version 1.14 and earlier versions that stems from a lack of a synchronization mechanism for loading geofencing data...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow lies in the lack of authentication. This allows attackers to gain access to the source code of DAGs.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to gain access to the source code of DAGs...

The vulnerability of the IBM QRadar SIEM system for event collection and analysis lies in the lack of protection for operational data, which allows attackers to exploit this weakness to disclose protected information.

The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

PT-2024-12424 · Cohesity · Cohesity Dataprotect

Name of the Vulnerable Software and Affected Versions: Cohesity DataProtect versions prior to 6.8.1 u5 Cohesity DataProtect versions prior to 7.1 Description: The issue is related to incorrect access control due to a lack of TLS Certificate Validation. Recommendations: For Cohesity DataProtect...

Flient Smart Door Lock Security Vulnerability

Flient Smart Door Lock is a smart door lock from Flient. The Flient Smart Door Lock has a security vulnerability that stems from the lack of encryption in the NFC tag...