Romanian arrested for ransomware attacks and data theft

By Deeba Ahmed Europol has confirmed arresting a Romanian national for targeting an IT firm in the country. This is a post from HackRead.com Read the original post: Romanian arrested for ransomware attacks and data theft...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the RSA Conference 2022 in San Francisco on February 8, 2022. I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn,...

snipe-it 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it suffers from a cross-site scripting vulnerability, which stems from vulnerability to incorrect input during web page generation. No detailed vulnerability details are currently available...

Snipe-IT Access Control Error Vulnerability

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...

Insecure Access Control

snipe/snipe-it is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient user permissions, allowing users to view model information via clone endpoint...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j-CVE-2021-44228 On December 5, 2021, Apache identified a...

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

GHSA-553Q-HPVP-Q8PC Server-Side Request Forgery in snipe/snipe-it

Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...

Server-Side Request Forgery in snipe/snipe-it

Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

Improper access control

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089 Improper Access Control in snipe/snipe-it

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

Snipe-IT is affected by an Improper Access Control vulnerability (CVE-2021-4089) affecting versions prior to 5.3.4. The issue arises because regular users with DENY to all models permissions can still view model data via the /models/{id}/clone endpoint due to missing authorize('view') checks. Imp...

Snipe-IT 访问控制错误漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...

PT-2021-23007 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.4 Description: The issue is related to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the "/models/id/clone" endpoint due to no authorize'view...

Improper Access Control in snipe/snipe-it

Description Regular users with DENY set to all models permissions can still view model information via the /models/id/clone endpoint due to no authorize'view' permission being set. Proof of Concept 1: Create regular user and set DENY to all permissions in asset models. 2: Login as the user 3:...

New research shows IoT and OT innovation is critical to business but comes with significant risks

The need for much improved IoT and operational technology OT cybersecurity became clearer this year with recent attacks on network devices,1 surveillance systems,2 an oil pipeline,3 and a water treatment facility,4 to name a few examples. To better understand the challenges customers are facing,...

New research shows IoT and OT innovation is critical to business but comes with significant risks

The need for much improved IoT and operational technology OT cybersecurity became clearer this year with recent attacks on network devices,1 surveillance systems,2 an oil pipeline,3 and a water treatment facility,4 to name a few examples. To better understand the challenges customers are facing,...