7428 matches found
GHSA-XC47-3RCH-CV57 Improper Access Control in snipe-it
Users with no system permissions are able to see and create personal access tokens...
Improper Access Control in snipe-it
Users with no system permissions are able to see and create personal access tokens...
Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA
We have recently uncovered a large-scale, multi-phase campaign that adds a novel technique to traditional phishing tactics by joining an attacker-operated device to an organization’s network to further propagate the campaign. We observed that the second stage of the campaign was successful agains...
Webinar: How to See More, But Respond Less with Enhanced Threat Visibility
The subject of threat visibility is a recurring one in cybersecurity. With an expanding attack surface due to the remote work transformation, cloud and SaaS computing and the proliferation of personal devices, seeing all the threats that are continuously bombarding the company is beyond...
it-world.ru Cross Site Scripting vulnerability OBB-2346698
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
January 25, 2022—KB5009616 (OS Build 17763.2510) Preview
None None...
Online Project Time Management System 1.0 - SQLi (Authenticated)
Exploit Title: Online Project Time Management System 1.0 - SQLi Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
[SECURITY] Fedora 35 Update: zabbix-5.0.19-1.fc35
Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...
[SECURITY] Fedora 34 Update: zabbix-5.0.19-1.fc34
Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...
GHSA-W3V3-CXQ5-9VR4 Incorrect Default Permissions and Improper Access Control in snipe-it
snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions...
Incorrect Default Permissions and Improper Access Control in snipe-it
snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions...
Zoho ManageEngine Applications Manager SQL Injection Vulnerability
ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. The product features application performance management, fault management, report generation, and SLA management.A security vulnerability exists in Zoho ManageEngine Applications Manager, which stems fr...
Hackers Attempt to Exploit New SolarWinds Serv-U Bug in Log4Shell Attacks
Microsoft on Wednesday disclosed details of a new security vulnerability in SolarWinds Serv-U software that it said was being weaponized by threat actors to propagate attacks leveraging the Log4j flaws to compromise targets. Tracked as CVE-2021-35247 CVSS score: 5.3, the issue is an "input...
CISA Releases Final Version of Guidance: IPv6 Considerations for TIC 3.0
CISA has released the final version of Internet Protocol version 6 IPv6 Considerations for Trusted Internet Connections TIC 3.0. This guidance supports the federal government-wide deployment and use of the modernized network protocol. The final version includes feedback provided during the public...
Cyber Threat Protection — It All Starts with Visibility
Just as animals use their senses to detect danger, cybersecurity depends on sensors to identify signals in the computing environment that may signal danger. The more highly tuned, diverse and coordinated the senses, the more likely one is to detect important signals that indicate danger. This,...
Privilege Escalation
snipe-it is vulnerable to privilege escalation. The vulnerability exists due to lack of santization of the auth controls on api key creation...
snipe-it Access Control Error Vulnerability (CNVD-2022-08381)
Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, which stems from the presence of improper access controls in the software. No details of the vulnerability are currently available...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m giving an online-only talk on “Securing a World of Physically Capable Computers” as part of Teleport’s Security Visionaries 2022 series, on January 18, 2022. I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking...
