2499 matches found
iranjasminco.com Cross Site Scripting vulnerability OBB-3625239
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle
Ask any security professional and they'll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate "fixer" somewhere in the organization. Thi...
The vulnerability of the email module in the Python programming language interpreter allows attackers to bypass the security measures.
The vulnerability of the email module in the Python programming language interpreter is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to bypass security measures remotely...
PT-2023-20580 · Ibm · Ibm Security Guardium Data Encryption
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Data Encryption version 1.10.3 Description: The issue is related to an inadequate account lockout setting in IBM Security Guardium Data Encryption, which could allow a remote attacker to brute force account credentials...
Trane Thermostats
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Low attack complexity Vendor: Trane Equipment: XL824, XL850, XL1050, and Pivot thermostats Vulnerability: Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as root...
PT-2023-25954 · Riverbed · Edgeconnect Sd-Wan Orchestrator
Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN Orchestrator versions prior to the versions resolved in this advisory Description: The issue is related to shared static SSH host keys for all installations, which could allow an attacker to spoof the SSH host signature and...
Monti Ransomware’s New Linux Variant Enhanced Encryption
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Monti ransomware, resembling Conti, resurfaces after a break, targeting legal and government sectors. A new Linux variant diverges significantly, using distinct tactics for encryption and virtual machine...
PT-2023-5856 · Supermicro · Supermicro X11Sse-F +1
Name of the Vulnerable Software and Affected Versions: Supermicro X11SSM-F version 1.66 Supermicro X11SAE-F version 1.66 Supermicro X11SSE-F version 1.66 Description: An issue exists in the web interface of Supermicro X11 series BMC IPMI servers due to inadequate protection of the web page...
What's the State of Credential theft in 2023?
At a little overt halfway through 2023, credential theft is still a major thorn in the side of IT teams. The heart of the problem is the value of data to cybercriminals and the evolution of the techniques they use to get hold of it. The 2023 Verizon Data Breach Investigations Report DBIR revealed...
hotelconventbegur.com Cross Site Scripting vulnerability OBB-3582289
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Researchers Shed Light on APT31's Advanced Backdoors and Data Exfiltration Tactics
The Chinese threat actor known as APT31 aka Bronze Vinewood, Judgement Panda, or Violet Typhoon has been linked to a set of advanced backdoors that are capable of exfiltrating harvested sensitive information to Dropbox. The malware is part of a broader collection of more than 15 implants that hav...
Double voting in GaugeController
Lines of code Vulnerability details Impact Voting with the same collateral multiple times by delegating and undelegating, a process that could manipulatively influenceincrease the weight of a particular lending market where the malicious actor is the major Liquidity provider. Proof of Concept The...
PT-2023-20409 · Unknown · Rigorous & Factory Pattern Dovetail Plugin
Name of the Vulnerable Software and Affected Versions: Rigorous & Factory Pattern Dovetail plugin versions 1.2.13 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Rigorous & Factory Pattern Dovetail plugin. This vulnerability requir...
2023 OWASP Top-10 Series: API2:2023 Broken Authentication
Welcome to the 3rd post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API2:2023 Broken Authentication. In this series we are taking an in-depth look at each category – the details, the impact and wha...
Cargo not respecting umask when extracting crate archives
The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed b...
Stored HTML injection
Description Stored HTML Injection: A Hidden Web Threat. Learn how attackers exploit input fields to inject malicious code into web applications, jeopardizing user data and site integrity. Discover crucial prevention measures to safeguard against this insidious vulnerability. Step to reproduce 1...
PT-2023-4152 · Mitsubishi · Gt Softgot2000 +3
Name of the Vulnerable Software and Affected Versions: GT Designer3 versions affected versions not specified GOT2000 Series versions affected versions not specified GOT SIMPLE Series versions affected versions not specified GT SoftGOT2000 versions affected versions not specified Description: The...
Code injection
The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...
Who Protects PII – Consumers or Companies?
Introduction Did you know that as a consumer, 25% of the apps you engage with are collecting your Personally Identifiable Information PII? Do you know why they are collecting it or where they are storing it? Also, do you realize as a company, General Data Protection Regulation GDPR fines can reac...
