Microsoft Releases Tool to Fix CrowdStrike-Caused Windows Chaos

Microsoft releases a recovery tool to fix CrowdStrike outages that crippled IT systems worldwide. The tool offers two…...

CrowdStrike update at center of Windows “Blue Screen of Death” outage

A faulty update from the cybersecurity vendor CrowdStrike crashed countless Windows computers and sent them into a “Blue Screen of Death” BSOD, grinding to a halt the global operations of airlines, hospitals, news broadcasters, transportation agencies, and more. The incident itself is not the...

Global IT Outage Causes Travel and Service Chaos: A Comprehensive Overview

A massive IT outage is sending shockwaves across the globe, leading to significant disruptions in travel, banking, and healthcare services. The chaos originated from two distinct issues: a misconfiguration that caused a Microsoft Azure service outage and a defective update in Crowdstrike's Falcon...

Huge Microsoft Outage Linked to CrowdStrike Takes Down Computers Around the World

A software update from cybersecurity company CrowdStrike appears to have inadvertently disrupted IT systems globally...

CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2024-37149

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16...

CVE-2024-37149

GLPI (open-source IT asset/ITIL service desk software) contains a vulnerability CVE-2024-37149 that enables remote code execution through the plugin loader. Exploitation requires an authenticated technician user who can upload a malicious PHP script, hijack the plugin loader, and execute the scri...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37148

Technical details (affected versions, components, fixes) are not provided in connected documents. The initial CVE description notes GLPI SQL injection with upgrade to 10.0.16. Monitor vendor advisories for updates.

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37147

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...

CVE-2024-37147 GLPI allows Authenticated File Upload to Restricted Tickets

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...

Enhance existing security workflows with high-fidelity cloud security data from Wiz in ServiceNow

Add Wiz’s cloud and container security context to your organization's ServiceNow CMDB, vulnerability response, and IT service management solutions...

Splunk Enterprise Cross-Site Scripting Vulnerability (CNVD-2024-34269)

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines and cloud. Splunk...

Malicious code in @zitterorg/reiciendis-maxime-beatae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 576d195ad97b9a6d69b9f70f3756a1ad7911da89670762ae6aa4399539ee521d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/consequuntur-voluptas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61345ad477e00411b68037a9b448ef2e1ca0beed5818baaed551d6ea2a0dbdf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/itaque-quae-dolore (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c7ab1e9fb28c3ea59e90ffacfd615f323775e17e135abb363d39b988b957125 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

m-it-connect.de Cross Site Scripting vulnerability OBB-3940487

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

it-sentry.com Cross Site Scripting vulnerability OBB-3939791

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...