The AnyDesk Breach: Overview and Recommendations

...

PT-2024-11055 · Meinberg · Meinberg Lantime-Firmware +1

Name of the Vulnerable Software and Affected Versions: Meinberg LANTIME-Firmware versions 6.24.029 and earlier Meinberg LANTIME-Firmware versions 7.04.008 and earlier Description: An issue was discovered in the LTOS-Web-Interface where path validation is mishandled. This allows an admin to read o...

PT-2024-1711

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.11.7 and earlier libxml2 versions 2.12.x through 2.12.4 Description A use-after-free flaw was found in the xmlValidatePopElement function of the libxml2 library when using the XML Reader interface with DTD validation and...

PT-2024-8689

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M26 Apache Tomcat versions 10.1.0-M1 through 10.1.30 Apache Tomcat versions 9.0.0-M1 through 9.0.95 Description The issue is related to an Unchecked Error Condition vulnerability in Apache Tomcat...

PT-2024-19017 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server versions 7.19.0 through 8.9.0 Confluence Data Center and Server version 4.3 Description: This Reflected XSS and CSRF vulnerability allows an unauthenticated attacker to execute arbitrary HTML or JavaScript co...

PT-2024-20111 · Ledgersmb +3 · Ledgersmb +3

Name of the Vulnerable Software and Affected Versions: LedgerSMB versions prior to 1.10.30 LedgerSMB versions prior to 1.11.9 Description: LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in "/setup.pl", an attacker can...

Facebook’s Extensive Surveillance Network

Consumer Reports is reporting that Facebook has built a massive surveillance network: Using a panel of 709 volunteers who shared archives of their Facebook data, Consumer Reports found that a total of 186,892 companies sent data about them to the social network. On average, each participant in th...

PT-2024-19473 · Beetl · Beetl

Name of the Vulnerable Software and Affected Versions: Beetl versions prior to 3.15.12 Description: The rendering template in Beetl has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklis...

The Wordfence 2023 State of WordPress Security Report

Today, the Wordfence Threat Intelligence team is releasing our 2023 State of WordPress Security Report as a free White Paper. In our report, we look at changes in the threat landscape, analyze impactful trends, and provide recommendations based on our findings. While most of our recommendations...

PT-2024-40543 · Amazon · Awskms

Name of the Vulnerable Software and Affected Versions: awskms and aesgcm providers affected versions not specified Description: The issue concerns the risk of an IV collision when using the awskms or aesgcm provider for encryption, particularly in scenarios like database column encryption where...

PT-2024-20362 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version V17.0.0cu.557 B20221024 Description: A command injection issue was discovered via the enable parameter in the setPortForwardRules function. This allows for potential exploitation. Recommendations: For TOTOLINK A3300R...

PT-2024-20363 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via the port or enable parameters in the setRemoteCfg function. Recommendations: For...

PT-2024-19626 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A security issue has been identified, but details are not provided in the given information. No estimated number of potentially affected devices...

Juniper Networks Releases Security Bulletin for J-Web in Junos OS SRX Series and EX Series

Juniper Networks released a security bulletin to address multiple vulnerabilities for J-Web in Junos OS SRX Series and EX Series. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Juniper...

PT-2024-4536 · Graphviz +5 · Graphviz +5

Name of the Vulnerable Software and Affected Versions: Graphviz versions 2.36.0 through 9.x before 10.0.1 Graphviz versions 2.36 before 10.0.0 Description: The issue is related to an out-of-bounds read in the Graphviz application, which can be exploited via a crafted config6a file. This may allow...

PT-2024-5052 · Netis Systems · Netis Systems Mw5360

Name of the Vulnerable Software and Affected Versions: NETIS SYSTEMS MW5360 version 1.0.1.3031 Description: The issue is related to a command injection vulnerability via the password parameter on the login page. This vulnerability may allow a remote attacker to execute arbitrary commands...

GHSA-MRQG-MWH7-Q94J Host header injection in the password reset

Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...

Host header injection in the password reset

Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...

PT-2024-13164 · Line · Line

Name of the Vulnerable Software and Affected Versions: Line version 13.6.1 Description: An issue in the Otakara lapis totuka mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token. This leakage enables attackers to exploit the system...

PT-2024-3256 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.7 MediaWiki versions 1.40.x prior to 1.40.3 MediaWiki versions 1.41.x prior to 1.41.1 Description: The issue is related to the incorrect neutralization of input during web page creation in the...