Identity in the Shadows: Shedding Light on Cybersecurity's Unseen Threats

In today's rapidly evolving digital landscape, organizations face an increasingly complex array of cybersecurity threats. The proliferation of cloud services and remote work arrangements has heightened the vulnerability of digital identities to exploitation, making it imperative for businesses to...

[SECURITY] Fedora 40 Update: amavis-2.13.1-1.fc40

amavis is a high-performance and reliable interface between mailer MTA and one or more content checkers: virus scanners, and/or Mail::SpamAssassin Perl module. It is written in Perl, assuring high reliability, portability and maintainability. It talks to MTA via ESMTP or LMTP, or by using helper...

The vulnerability of microprogramming software in embedded Qualcomm chips, related to insufficient verification of input data, allows a hacker to execute arbitrary code.

The vulnerability of embedded software developed by Qualcomm relates to insufficient validation of input data. Exploiting this vulnerability can allow attackers to execute arbitrary code...

PT-2024-18508 · Flashc · Flashc

Name of the Vulnerable Software and Affected Versions: flashc affected versions not specified Description: The issue is related to a possible out of bounds write in flashc due to a lack of validation. This could lead to local escalation of privilege, with System execution privileges needed. User...

The vulnerability of the Intel Driver & Support Assistant software in updating drivers allows attackers to exploit access control deficiencies, enabling them to escalate their privileges.

The vulnerability of the Intel Driver & Support Assistant software for updating drivers is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the RESTEasy software lies in the lack of protective measures for website structures, allowing attackers to carry out XSS attacks.

The vulnerability of the RESTEasy software is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerabilities of Mitsubishi Electric’s software products, including EZSocket, FR Configurator2, GT Designer3 Version1(GOT1000), GT Designer3 Version1(GOT2000), GX Works2, GX Works3, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA (software included with MC Works64), are related to the absence of authentication for critical functions. This allows attackers to gain unauthorized access to confidential information.

The vulnerabilities of Mitsubishi Electric’s software products, including EZSocket, FR Configurator2, GT Designer3 Version1GOT1000, GT Designer3 Version1GOT2000, GX Works2, GX Works3, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA software included with MC Works64, are relate...

Identify and De-risk Unmanaged, Unauthorized Devices With Qualys CyberSecurity Asset Management (CSAM)

69% of organizations said they experienced at least one cyberattack resulting from an exploit of an unknown or unmanaged asset such as software, cloud-based workloads user accounts, and IoT devices. Ultimately, these attacks stem from visibility gaps in the attack surface. Bringing these assets...

USN-6548-5 linux-iot vulnerabilities

It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could potentially use this to expose sensitive information. CVE-2023-3006 It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors i...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in the MediaTek chips that stems from a lack of boundary checking in the Modem IMS Stack module, which may cause a system crash...

PT-2023-31712 · Unknown · Englesystem

Name of the Vulnerable Software and Affected Versions: Englesystem versions prior to 3.4.1 Description: Englesystem is a shift planning system for chaos events. The system performed insufficient validation of user-supplied data for the DECT number, mobile number, and work-log comment fields. This...

The vulnerability of Adobe Experience Manager’s content and media data management system, which stems from the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of Adobe Experience Manager’s content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to disclose protected information.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

The vulnerability of the ASUSTOR Data Master operating system, related to the lack of measures taken to clean data at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the ASUSTOR Data Master operating system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of Cisco Firepower Threat Defense’s microprogramming software lies in the lack of proper validation of input data, allowing attackers to trigger a Denial-of-Service Attack (DoS).

The vulnerability of Cisco Firepower Threat Defense’s microprogramming software exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to trigger a Denial-of-Service Attack DoS...

The vulnerability in the web interface of the Aruba EdgeConnect Enterprise network management platform allows a attacker to execute arbitrary code.

The vulnerability of the web interface for managing the Aruba EdgeConnect Enterprise network management platform exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2023-28109 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue allows unrestricted upload of files with dangerous types, specifically PHP executable files, through the file manager. This is due to accessing functionality not properly constrained...

The vulnerability of NagiosXI software, related to the lack of measures taken to protect the website structure, allows attackers to execute XSS-type attacks.

The vulnerability of NagiosXI software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out a type of attack known as reflected XSS...

The vulnerability of the Commons FileUpload component in the Apache Tomcat application server arises due to incomplete cleanup of temporary or auxiliary resources, allowing attackers to cause service failures.

The vulnerability of the Commons FileUpload component in the Apache Tomcat application server exists due to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) lies in their insufficiently checked incoming requests, allowing a perpetrator to trigger a service failure.

The vulnerabilities of the Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, and Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P are related to insufficient checking of incoming requests duri...