CVE-2023-43664 Employee without any access rights can list all installed modules in Prestashop

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is...

PrestaShop allows employee without any access rights to list all installed modules

Impact In BO, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights Patches Fixed on 8.1.2 Workarounds References...

CVE-2023-35990

The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be able to identify what other apps a user has installed...

PT-2023-6033 · Apple · Macos Sonoma +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17 iPadOS versions prior to 17 watchOS versions prior to 10 iOS versions prior to 16.7 iPadOS versions prior to 16.7 macOS Sonoma versions prior to 14 Description: The issue allows an app to identify what other apps a us...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS 17 and iPadOS 17, which stems from the fact that an application m...

The vulnerability of the microprogrammed Wi-Fi router software from Juplink RX4-1500, related to the use of pre-installed credentials, allows a hacker to escalate their privileges.

The vulnerability of the microprogrammed Wi-Fi router software from Juplink RX4-1500 lies in the use of pre-set login credentials. Exploiting this vulnerability allows a remote attacker to enhance their privileges by connecting through a web interface or Telnet service...

Maxthon Browser Installed (Windows)

Binary data maxthonbrowserwininstalled.nbin...

CVE-2023-4802

A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management ITM Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to...

Adobe Lightroom Classic Installed (macOS)

Binary data lightroomclassicmacosxinstalled.nbin...

Python Installed Packages

Binary data pythonpackageswininstalled.nbin...

The vulnerability of the Google Maps API Super Store Finder software lies in its use of pre-installed credentials, allowing a hacker to gain access to the administration panel.

The vulnerability of the Google Maps API Super Store Finder integration tool is related to the use of pre-installed credentials. Exploiting this vulnerability could allow a malicious actor to gain access to the administration panel remotely...

Apache Airflow Installed (Windows)

Binary data apacheairflowwininstalled.nbin...

Fedora 38 : python3.8 (2023-af9e3098a5)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-af9e3098a5 advisory. Update to 3.8.18 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

RHEL 8 : firefox (RHSA-2023:4951)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4951 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

VDA logs FAS event 107 continuously if Advyza is installed

Users cannot access Domain resources like Network shares, Internal websites, Applications which need Domain/Windows authentication after 5 minutes of logon. Users can access Domain resources soon after they logon, but if they try to access any new resource after 5 minutes, it fails or prompts for...

CODESYS Development System Installed (Windows)

Binary data codesyssystemdevelopmentwininstalled.nbin...

Part III: Implementing Effective Cyber Security Metrics that Reduce Risk Realistically

We outlined some critical cybersecurity metrics in Part I of this three-part blog series. In the final blog post, we will delve into three crucial aspects outlined in Josh’s article: tactical metrics for operational teams, strategic metrics for leadership, and the metrics addressing the...

PT-2023-26914 · Unknown · Pms Module

Name of the Vulnerable Software and Affected Versions: PMS module affected versions not specified Description: The issue is related to the PMS module, where input parameters are not strictly verified. This can cause newly installed apps to fail to restart if the vulnerability is successfully...

Ivanti Desktop and Server Management Security Vulnerability

Ivanti Desktop and Server Management is a multi-platform, unified endpoint management solution from Ivanti Corporation. A security vulnerability exists in Ivanti Desktop and Server Management 2022.2 SU2 and prior versions, which originated from a vulnerability that allows a low-privileged attacke...

CVE-2023-38556

Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. Note Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers via a web browser. Web Config is pre-installed in som...