CVE-2024-48912 GLPI vulnerable to authenticated insecure account deletion

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue...

How Red Teaming Helps Meet DORA Requirements

The Digital Operational Resilience Act DORA sets strict EU rules for financial institutions and IT providers, emphasizing strong…...

CVE-2023-47871

Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6...

CVE-2023-47871 WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6...

CVE-2023-47871 WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6...

Story of the Year: global IT outages and supply chain attacks

A faulty update by cybersecurity firm CrowdStrike triggered one of the largest IT outages in history, impacting approximately 8.5 million systems worldwide. This incident serves as a stark reminder of the critical risks posed by global IT disruptions and supply chain weaknesses. With large-scale...

PT-2024-13527 · It Path Solutions · It Path Solutions Contact Form To Any Api

Name of the Vulnerable Software and Affected Versions: IT Path Solutions Contact Form to Any API versions 1.1.6 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels...

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Executive Summary Beginning in early October, Rapid7 has observed a resurgence of activity related to the ongoing social engineering campaign being conducted by Black Basta ransomware operators. Rapid7 initially reported the discovery of the novel social engineering campaign back in May, 2024,...

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Executive Summary Beginning in early October, Rapid7 has observed a resurgence of activity related to the ongoing social engineering campaign being conducted by Black Basta ransomware operators. Rapid7 initially reported the discovery of the novel social engineering campaign back in May, 2024,...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform Execution Environments Container Release Update

An update is now available for Red Hat Ansible Automation Platform Execution Environments Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

SmokeLoader Malware Resurfaces, Targeting Manufacturing and IT in Taiwan

Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware. "SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide ran...

World Tour Survey: IT Operations’ Hands-on Defense

Trend surveyed 750 cybersecurity professionals in 49 countries to learn more about the state of cybersecurity, from job pressures to the need for more advanced tools. Explore what IT operations teams had to say...

Malicious code in distdiscord-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df4e3ffa3125383f7eefd22447c1d5f54c29993ca1aa53c9fa243ddd464e0c69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dogwiftools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 072830cdf24f92d02ea5bb6ca4b9c474b7fa3a234ddfb1b98eaaccbc8cc06842 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-53855 User can view tickets from organizations they're not apart of in centurion_erp

Centurion ERP Enterprise Rescource Planning is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management ITSM modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they...

CVE-2024-53855 User can view tickets from organizations they're not apart of in centurion_erp

Centurion ERP Enterprise Rescource Planning is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management ITSM modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they...

CVE-2024-53855 User can view tickets from organizations they're not apart of in centurion_erp

Centurion ERP Enterprise Rescource Planning is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management ITSM modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they...

Malicious code in eslint-plugin-classification-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf941eb64cb46effcedb0a7bc56e9aa2c3a16f53b93efc19baecb91bc6699f02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...