2499 matches found
PT-2023-5416 · D Link · D-Link Dir-806
Name of the Vulnerable Software and Affected Versions: D-LINK DIR-806 versions DIR806A1 FW100CNb11 Description: The issue is related to the lack of data cleaning measures at the management level, which can be exploited by a remote attacker to execute arbitrary commands using the REMOTE PORT...
Omron Engineering Software
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION : Low attack complexity Vendor : Omron Equipment : Sysmac Studio Vulnerability : Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS...
The MGM Cybersecurity Breach: Learnings and Prevention Measures
As many are aware, the systems of the $14 billion dollar gaming and hospitality giant MGM have been brought to a halt for nearly 5 days due to a multi-vector attack that has come to affect Caesars Entertainment as well. While the culprits of the attack are not confirmed, hacking group Scattered...
calipoke.ae Cross Site Scripting vulnerability OBB-3691313
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
2023 OWASP Top-10 Series: API8:2023 Security Misconfiguration
Welcome to the 9th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API8:2023 Security Misconfiguration. In this series we are taking an in-depth look at each category – the details, the impact and...
CVE-2023-4959
A flaw was found in Quay. Cross-site request forgery CSRF attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the...
Siemens Spectrum Power 7
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
The vulnerability of HTML objects in the software tool for managing identities and access control allows a hacker to carry out XSS attacks.
The vulnerability of HTML objects in software tools for managing identities and access control is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
Strapi Improper Rate Limiting vulnerability
Summary There is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. 2. Details It is possible to avoid this by modifying the rate-limited request path as follows. 1. Manipulating request paths to upper or lower case. Pattern 1 - In this case,...
MAL-2023-8090 Malicious code in cloud-message-sdks (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 479df48e71ae41e05b71f56e47a5a0a444e5992d40ed13730baf980dd5d3e7ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-5189 · Unknown · Qms Automotive
Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which does not properly invalidate session tokens upon logout. This could allow an attacker to perform session...
lomaperkkio.bookingonline.fi Cross Site Scripting vulnerability OBB-3666952
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
The main causes of ransomware reinfection
A few months ago, we wrote about a ransomware reinfection incident. Ransomware reinfection arguably could be even worse than being a first time victim. Unfortunately it happens more often than you may think. Research shows that in 2022, more than a third 38% of surveyed organizations fell victim ...
The vulnerability of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability arises due to the failure to take measures to eliminate special elements within it, allowing attackers to execute arbitrary code.
The vulnerability of the XWiki platform lies in its lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Vulnerability fixed in Cisco ASA and Firepower systems
Cisco has fixed a vulnerability in Adaptive Security Appliance and Firepower Threat Defense. The vulnerability is located in the way the Remote Access VPN handles login attempts, allowing a malicious party to use brute-force access to user accounts and potentially take over the system. take over...
photographybyeiko.com Cross Site Scripting vulnerability OBB-3651440
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Cybersecurity for Startups: Best Tips and Strategies
By Owais Sultan In this article, we will discuss cybersecurity for startups and how implementing effective measures can contribute to their overall success and growth This is a post from HackRead.com Read the original post: Cybersecurity for Startups: Best Tips and Strategies...
GE Digital CIMPLICITY
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: GE Digital Equipment: CIMPLICITY Vulnerability: Process Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a low-privileged local attacker to escalate privileges to SYSTEM. 3...
PT-2023-5223 · Ibm · Ibm Security Verify Information Queue
Name of the Vulnerable Software and Affected Versions: IBM Security Verify Information Queue versions 10.0.4 through 10.0.5 Description: The issue is related to the storage of sensitive information in plain clear text, which can be accessed by a local user. This is due to a lack of encryption...
km-bsafe.com Cross Site Scripting vulnerability OBB-3627569
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...