PT-2023-4376 · Microsoft · Windows Group Policy +1

Name of the Vulnerable Software and Affected Versions: Windows Group Policy affected versions not specified Description: The issue is related to a security feature bypass in the Windows Group Policy component, which is associated with a lack of protection for service data. This could allow an...

Microsoft Windows Group Policy Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Group Policy. An attacker could exploit this vulnerability to bypass certain features. The following products and...

CVE-2023-38770

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php...

North Korean Hackers Targets Russian Missile Engineering Firm

Two different North Korean nation-state actors have been linked to a cyber intrusion against NPO Mashinostroyeniya, a major Russian missile engineering company. Cybersecurity firm SentinelOne said it identified "two instances of North Korea related compromise of sensitive internal IT...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the Google IAP details in Prometheus integration are not properly hidden, which leads to the leak of project settings, instance and group details to other users...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to lack of cascading deletes in GitLab which allows a malicious attacker to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to improper view permissions which allows an attacker to see pending invitations of any public group or public project by visiting an API endpoint...

vescovinigroup.eu Cross Site Scripting vulnerability OBB-3570401

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. The vulnerability exists under specialized conditions, which allows an attacker to use an invite URL meant for another email address to gain access to a group...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This issue allows a member of a private group to validate the use of a specific name for a private project resulting in generation of error message containing sensitive information...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. This allows a group maintainer to modify the group CI/CD variables resulting in a authorization issue...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. It is possible for an unauthorized authenticated user to add child epics linked to victim's epic in an unrelated group...

Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems

Threat actors are using an open-source rootkit called Reptile to target Linux systems in South Korea. "Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of...

Microsoft Teams used in phishing campaign to bypass multi-factor authentication

Attackers believed to have ties to Russia's Foreign Intelligence Service SVR are using Microsoft Teams chats as credential theft phishing lures. Microsoft Threat Intelligence has posted details about the perceived attacks targeted at fewer than 40 unique global organizations. The targeted...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab that stems from a vulnerability that...

CVE-2023-37498

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges...

CVE-2023-37498 HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges...

"Mysterious Team Bangladesh" Targeting India with DDoS Attacks and Data Breaches

A hacktivist group known as Mysterious Team Bangladesh has been linked to over 750 distributed denial-of-service DDoS attacks and 78 website defacements since June 2022. "The group most frequently attacks logistics, government, and financial sector organizations in India and Israel,"...

Global ransomware attacks at an all-time high, shows latest 2023 State of Ransomware report

Ransomware attacks have shown no signs of slowing down in 2023. A new report from the Malwarebytes Threat Intelligence team shows 1,900 total ransomware attacks within just four countries--the US, Germany, France, and the UK--in one year. The findings, compiled together in the 2023 State of...

HCL Unica Platform Security Vulnerability

HCL Technologies HCL Unica Platform is a state-of-the-art enterprise automated marketing platform from HCL Technologies, USA. No manual effort is required to handle routine marketing tasks and capture the most effective leads. A security vulnerability exists in HCL Unica Platform versions prior t...