New Secaucus Point of Presence Increases Resilience for Financial Services

We are thrilled to announce the opening of a new cutting-edge Point of Presence PoP in Secaucus, New Jersey, which adds resilience to our network infrastructure located in the Northeastern United States region. This PoP represents the first build using next generation technology designed to...

Mitsubishi Electric MELSEC iQ-F/iQ-R Series CPU Module (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Exploitable remotely/low attack complexity Equipment : MELSEC iQ-F/iQ-R Series Vulnerability : Improper Restriction of Excessive Authentication Attempts 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote...

Weintek EasyBuilder Pro

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Weintek Equipment : EasyBuilder Pro Vulnerability : Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain remote...

Franklin Fueling System TS-550

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Franklin Fueling System Equipment : TS-550 Vulnerability : Use of Password Hash with Insufficient Computational Effort 2. RISK EVALUATION Successful...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows a perpetrator to gain access to read, modify, add, or delete data, or to cause service interruptions.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add, or delete data, or to cause service...

SUSE CVE-2018-1080

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules authz.evaluateOrder=allow,deny, then allow rules will...

SUSE CVE-2021-3551

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threa...

RansomedVC Ransomware Group Quitting and Selling its Entire Infrastructure

By Waqas The infamous RansomedVC Ransomware Group is calling it quits and selling its entire cyber infrastructure due to "personal reasons." This is a post from HackRead.com Read the original post: RansomedVC Ransomware Group Quitting and Selling its Entire Infrastructure...

New Webinar: 5 Must-Know Trends Impacting AppSec

Modern web app development relies on cloud infrastructure and containerization. These technologies scale on demand, handling millions of daily file transfers – it's almost impossible to imagine a world without them. However, they also introduce multiple attack vectors that exploit file uploads wh...

Virtuozzo Hybrid Infrastructure 5.1 Update 1 Hotfix 1 (5.1.1-71)

This update provides an important security fix. Vulnerability id: VSTOR-75357 Fixed a critical security vulnerability...

Virtuozzo Hybrid Infrastructure 5.2 Update 1 Hotfix 1 (5.2.1-69)

This update provides important security and stability fixes. Vulnerability id: VSTOR-75357 Fixed a critical security vulnerability. Vulnerability id: VSTOR-60071 Fixed a problem that occurs while opening backup archives with erasure coding. Vulnerability id: VSTOR-58571 The core storage crashed d...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 2 (5.4.4-132)

This update provides important stability, security, and performance improvements. Vulnerability id: VSTOR-75357 Fixed a critical security vulnerability. Vulnerability id: VSTOR-76306 Fixed a problem that may occur while closing files with erasure coding. Vulnerability id: VSTOR-76257 Add the...

Virtuozzo Hybrid Infrastructure 5.3 Update 1 Hotfix 3 (5.3.1-53)

This update provides an important security fix. Vulnerability id: VSTOR-75357 Fixed a critical security vulnerability...

An integrated incident response solution with Microsoft and PwC

Today Microsoft Incident Response is excited to announce a new collaboration with PwC to expand our joint incident response and recovery capability. In this global alliance, Microsoft begins the initial containment and investigation, bringing a deep understanding of a company’s infrastructure to...

CVE-2023-46238 XSS with User Avatar image in ZITADEL

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to...

CVE-2023-46238

ZITADEL’s CVE-2023-46238 vulnerability affects the Avatar SVG upload feature. An attacker can exploit SVGs containing scripts due to a missing security header, potentially gaining access to a victim’s account when the SVG is opened in the browser during a active session. Impact is described as re...

Dingtian DT-R002

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Exploitable remotely/public exploits are available Vendor : Dingtian Equipment : DT-R002 Vulnerability : Authentication Bypass by Capture-Replay 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

Information disclosure

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to gain read, modify, add, or delete access to data.

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add, or delete data...