CVE-2023-39514

Cacti (web-based graphing/monitoring tool) is affected by CVE-2023-39514 due to a stored XSS vulnerability in the graphs view. A authenticated user with appropriate privileges can poison data in the Cacti database by injecting malicious content into data-source names or device names via data_temp...

CVE-2023-39514 Stored Cross-site Scripting on graphs.php data template formated name view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent software for data protection, Acronis Cyber Protect 15, arises from insufficient protection of operational data. This vulnerability allows attackers to gain unauthorized access to protected information.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent software for data protection, Acronis Cyber Protect 15, is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to gain unauthorized access to...

Navigating Legacy Infrastructure: A CISO's Actionable Strategy for Success

Every company has some level of tech debt. Unless you're a brand new start-up, you most likely have a patchwork of solutions that have been implemented throughout the years, often under various leadership teams with different priorities and goals. As those technologies age, they can leave your...

Three Security Vendor Consolidation Myths Debunked

When it comes to security vendor consolidation, Gartner found that 57% of organizations are working with fewer than ten security vendors, utilizing consolidation to cut costs and improve their overall security posture. But what about the other 43%? While security vendor consolidation has many...

The vulnerability of the Apache Tomcat application server lies in the lack of protection for operational data, allowing attackers to access confidential information.

The vulnerability of the Apache Tomcat application server is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential information...

The vulnerability of the Windows Message Queuing system, which allows a perpetrator to disclose protected information

The vulnerability of Windows’ Message Queuing system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the copy function for essential data provided by the supplier to business partners of the SAP Supplier Relationship Management application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the copy function for the supplier’s main data for application partners of SAP Supplier Relationship Management relates to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access...

The vulnerability of SAP BusinessObjects Business Intelligence platform, related to insufficient protection of operational data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SAP BusinessObjects Business Intelligence platform is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

The vulnerability of Microsoft SharePoint Server software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Microsoft SharePoint Server packages is related to insufficient protection of operational data. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information remotely...

The vulnerability of the VMware Horizon Server virtualization server allows a intruder to gain unauthorized access to confidential information.

The vulnerability of the VMware Horizon Server virtualization server lies in the insufficient protection of operational data. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to confidential information...

Security Bulletin: IBM Operational Decision Manager July 2023 - Multiple CVEs

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2022-41946 DESCRIPTION: Postgresql JDBC could allow a...

The vulnerability of the web platform used for creating ZKBio Access lVS control and access management systems stems from insufficient protection of sensitive data. This allows a malicious actor to gain unauthorized access to the protected information.

The vulnerability of the web platform used for creating ZKBio Access lVS access control and management systems is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

MTE As Implemented, Part 2: Mitigation Case Studies

By Mark Brand, Project Zero Background In 2018, in the v8.5a version of the ARM architecture, ARM proposed a hardware implementation of tagged memory, referred to as MTE Memory Tagging Extensions. In Part 1 we discussed testing the technical and implementation limitations of MTE on the hardware...

The vulnerability of the The Message Display Tool (MDT) software component, used for integrating corporate applications in SAP NetWeaver Process Integration, allows a perpetrator to disclose protected information.

The vulnerability of the The Message Display Tool MDT software component, used for integrating corporate applications in SAP NetWeaver Process Integration, is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive...

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall management system lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System GMS global network firewall management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gai...

The vulnerability of the OLE Automation technology in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OLE Automation technology in Windows operating systems is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of the IBM InfoSphere Information Server software platform, related to insufficient protection of operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM InfoSphere Information Server software platform is related to insufficient protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-36884 Microsoft Office and Windows HTML Remote Code Execution Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors...

Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens

Microsoft on Friday said a validation error in its source code allowed for Azure Active Directory Azure AD tokens to be forged by a malicious actor known as Storm-0558 using a Microsoft account MSA consumer signing key to breach two dozen organizations. "Storm-0558 acquired an inactive MSA consum...