CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery CSRF. It enables attackers to perform changes in the monitoring...

The vulnerability of the WP Sessions Time Monitoring plugin in the fully automatic WordPress content management system allows attackers to expose protected information.

The vulnerability of the WP Sessions Time Monitoring full-automatic content management system’s plugin is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to disclose the protected information...

GHSA-259P-RVJX-FFWG Panel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

Summary .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. Details If the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its o...

Digital Experience Monitoring | What Is DEM?

Introduction to Digital Experience Monitoring: Illuminating the Basics In an era governed by technology, the satisfaction of an end-user is of utmost importance. It has the power to stimulate or to halt business growth, and frequently determines if a client continues or discontinues their...

Elastic APM Log Information Disclosure Vulnerability

Elastic APM is a platform for monitoring and analyzing application performance from Elastic Netherlands. A log information disclosure vulnerability exists in Elastic APM Server versions prior to 8.12.1, which stems from a vulnerability that could lead to the insertion of sensitive or private...

APM Server 8.12.1 Security Update (ESA-2024-03)

APM Server Insertion of Sensitive Information into Log File ESA-2024-03 An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the...

Four Key Benefits of Rapid7’s New Managed Digital Risk Protection Service

Cybercrime has boomed to the third largest economy in the world behind the US and China Cybernews, with much of the most nefarious behavior on the dark web. Monitoring it effectively can be the key to identifying the earliest signals of an attack – and the difference between a minor event and a...

HPESBGN04590 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Arbitrary File Modification; Remote: Arbitrary Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC - Prior to v3.1.1 CVSS Scores: | CVE | CVSS Vector | Base...

Design/Logic Flaw

MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users...

CVE-2023-49115 MachineSense FeverWarn Missing Authentication for Critical Function

MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users...

CVE-2023-49115

CVE-2023-49115 concerns MachineSense FeverWarn devices where unauthenticated MQTT messaging allows remote viewing of sensor data. Affected components include FeverWarn ESP32, FeverWarn RaspberryPi, and FeverWarn DataHub RaspberryPi. Root cause stated across sources is missing authentication for c...

Optimizing Data Lakes: Streamlining Storage with Effective Object Management

Data lakes are a popular solution for data storage, and for good reason. Data lakes are flexible and cost effective, as they allow multiple query engines and many object formats without the need to manage resources like disks, CPUs, and memory. In a data lake, data is simply stored in an object...

Identify and De-risk Unmanaged, Unauthorized Devices With Qualys CyberSecurity Asset Management (CSAM)

69% of organizations said they experienced at least one cyberattack resulting from an exploit of an unknown or unmanaged asset such as software, cloud-based workloads user accounts, and IoT devices. Ultimately, these attacks stem from visibility gaps in the attack surface. Bringing these assets...

kernel: use-after-free bug in remove function xgene_hwmon_remove

A use-after-free flaw was found in xgenehwmonremove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel driver xgene-hwmon. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak...

CVE-2024-23822

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

Path traversal

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

CVE-2024-23822 Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

CVE-2024-23822

CVE-2024-23822 affects Thruk, a multibackend web monitoring interface. Prior to version 3.12, the product’s file upload form allows a threat actor to perform a path traversal vulnerability, enabling arbitrary file uploads to chosen server paths and permissions. The root cause is insufficient vali...

MachineSense FeverWarn Access Control Error Vulnerability

MachineSense FeverWarn is a temperature detection device from MachineSense. An access control error vulnerability exists in MachineSense FeverWarn that stems from the use of unauthenticated MQTT messaging to monitor the device and remotely view sensor data by a user...

Security Operations (SecOps)

Understanding the Basics of Security Operations SecOps SecOps represents the blending of cybersecurity proficiency with operational domains, forming a powerful bulwark. Its primary mission lies in safeguarding the fundamental data assets and technological infrastructures of an organization. More...