The Challenge of Securing APIs for a Luxury Hotel Chain

...

CVE-2023-39522

goauthentik (open‑source Identity Provider) contains a vulnerability in affected versions using a recovery flow with an identification stage that allows an attacker to determine whether a username exists, enabling username/email enumeration. The issue affects setups with the recovery flow and can...

CVE-2023-40890

Summary: CVE-2023-40890 affects ZBar 0.23.90 and describes a stack-based buffer overflow in the lookup_sequence function. Attackers can trigger via specially crafted QR codes scanned by vulnerable hardware/software, with potential information disclosure and arbitrary code execution as indicated b...

Loss of precision due to division occurring before multiplication across multiple statements leads to lesser number of receiving tokens

Lines of code Vulnerability details Impact Swaps and Deposits work with two tokens X and Y. The computed amount of tokens on the receiving end decrease due to this multi-statement loss of precision occurring due to division before multiplication. Note: This finding is different from the L-06 bot...

CVE-2023-40758

CVE-2023-40758 affects PHPJabbers Document Creator v1.0. The issue is a user-enumeration vulnerability during the password-recovery process caused by differing response messages that let an attacker determine whether a given username exists, enabling targeted brute-forcing with valid users. The a...

Defying the Dark Arts: Strategies for Countering Cyber Threats

By Waqas In todays digitized landscape, where technology connects us in ways we couldnt have imagined just a few decades… This is a post from HackRead.com Read the original post: Defying the Dark Arts: Strategies for Countering Cyber Threats...

Information Leakage Vulnerability in Renzi's Next-Generation Firewalls

Ltd. is one of the earliest enterprises in China to be involved in the field of network information security, and is committed to providing overall solutions for network auditing and supervision for state management organizations, operators, enterprises and institutions. An information leakage...

Design/Logic Flaw

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 22.24.5800.0 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit...

CVE-2023-38712

An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state...

Design/Logic Flaw

Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access...

CVE-2023-38508

Summary: CVE-2023-38508 affects Tuleap: Community Edition < 14.11.99.28 and Enterprise Edition < 14.10-6,

CVE-2023-4420

CVE-2023-4420 affects SICK LMS5xx devices. The vulnerability arises from the absence of Transport Layer Security, leaving the communication channel unencrypted and allowing a remote unprivileged attacker to eavesdrop and potentially manipulate data between LMS5xx and the client. Impacts include c...

CVE-2023-4418

The CVE-2023-4418 issue affects the SICK LMS5xx family, where a remote unauthenticated attacker can induce a TCP SYN flood to exhaust resources and render the LMS5xx unavailable. Several connected documents confirm a network-based DoS via TCP SYN requests impacting availability, with PT-2023-2914...

CVE-2023-4230

Affected product/versions: ioLogik 4000 Series (ioLogik E4200) firmware v1.6 and prior. Root cause: lack of protection for service data in the web server, enabling a remote attacker to access protected information. Impact: potential exposure of information about the device and its configuration t...

web2.gov.mb.ca Cross Site Scripting vulnerability OBB-3614522

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-4556 · Moxa · Iologik 4000 Series

Name of the Vulnerable Software and Affected Versions: ioLogik 4000 Series ioLogik E4200 versions v1.6 and prior Description: A vulnerability has been identified that may facilitate the collection of information on ioLogik 4000 Series devices, potentially enabling attackers to gather information...

Rakuten WiFi Pocket vulnerable to improper authentication

Overview Rakuten WiFi Pocket provided by Rakuten Mobile, Inc. is a mobile router. Management Screen of Rakuten WiFi Pocket contains an improper authentication vulnerability CWE-287. Sato Nobuhiro of Suzuki Motor Corporation and You Okuma of LAC Co., Ltd. reported this vulnerability to IPA...

PT-2023-27810 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. It appears to be a notification about a candidate number that is not in use...

CVE-2023-38733

CVE-2023-38733 affects IBM Robotic Process Automation server. An authenticated user could view sensitive information from installation logs, exposing data such as database connection strings. Affected versions include 21.0.0–21.0.7.3 and 23.0.0–23.0.3. Root cause relates to insufficient protectio...

CVE-2023-37440

CVE-2023-37440 affects Aruba Networks EdgeConnect SD-WAN Orchestrator (web-based management interface). The vulnerability is a Server-Side Request Forgery (SSRF) that could allow an unauthenticated remote attacker to enumerate internal host information and potentially disclose sensitive data. The...