PT-2023-4568

Name of the Vulnerable Software and Affected Versions Google Guava versions 1.0 through 31.1 Description The issue is related to the use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava. This allows other users and apps on the machine with access t...

Akamai’s Perspective on June’s Patch Tuesday 2023

Every Patch Tuesday stirs up the community. See Akamai's insights and recommendations on what to focus on, and patch, patch, patch!...

Siemens SIMATIC WinCC V7

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-3371 · Siemens · Simatic Pcs 7 +2

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions prior to V9.1 SP2 UC04 SIMATIC S7-PM versions prior to V5.7 SP1 HF1 SIMATIC S7-PM versions prior to V5.7 SP2 HF1 SIMATIC STEP 7 V5 versions prior to V5.7 Description: A vulnerability has been identified in the affected...

PT-2023-3213 · Microsoft · Streaming Service +2

Name of the Vulnerable Software and Affected Versions: Microsoft Streaming Service versions prior to the fixed version Description: The issue allows attackers to gain System privileges on a vulnerable machine. It is an elevation-of-privilege vulnerability that affects the system. The vulnerabilit...

MOVEit SQLi Zero-Day (CVE-2023-34362) Exploited by CL0P Ransomware Group

Akamai Security Intelligence Group, which has been examining the MOVEit vulnerability and its exploitation, provides recommendations for detection and mitigation...

Sensormatic Electronics Illustra Pro Gen 4

1. EXECUTIVE SUMMARY ​CVSS v3 8.3 ​ATTENTION: Exploitable via adjacent network ​Vendor: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. ​Equipment: Illustra Pro Gen 4 ​Vulnerability: Active Debug Code 2. RISK EVALUATION ​Successful exploitation of this vulnerability could allow an...

avo possible unsafe reflection / partial DoS vulnerability

Summary The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. Details After reviewing th...

PT-2023-5344 · Libspdm · Libspdm

Name of the Vulnerable Software and Affected Versions: libspdm versions prior to 2.3.3 libspdm versions prior to 3.0 Description: The issue arises due to insufficient validation of input data in the libspdm library. This can be exploited by a remote attacker to cause a denial of service. When a...

PT-2023-13140 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected CVE candidate...

PT-2023-20298 · WordPress · Sebastian Krysmanski Upload File Type Settings

Name of the Vulnerable Software and Affected Versions: Sebastian Krysmanski Upload File Type Settings plugin versions = 1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For...

PT-2023-14655 · Tyche Softwares · Custom Order Numbers For Woocommerce

Name of the Vulnerable Software and Affected Versions: Tyche Softwares Custom Order Numbers for WooCommerce plugin versions = 1.4.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-23968 · Adyen +1 · Adyen +1

Name of the Vulnerable Software and Affected Versions: Saleor Core versions prior to 3.7.68 Saleor Core versions prior to 3.8.40 Saleor Core versions prior to 3.9.49 Saleor Core versions prior to 3.10.36 Saleor Core versions prior to 3.11.35 Saleor Core versions prior to 3.12.25 Saleor Core...

PT-2023-24588 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.48 Liferay DXP 7.4 before update 49 Description: The issue allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope...

PT-2023-18606 · T&D +1 · Tr-71W/72W +7

Name of the Vulnerable Software and Affected Versions: T&D Corporation data logger products TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions ESPEC MIC CORP. data logger products RT-12N/RS-12N a...

Future Exploitation Vector: File Extensions as Top-Level Domains

In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains TLDs while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards...

PT-2023-18896 · Garmin · Ciq Api

Name of the Vulnerable Software and Affected Versions: CIQ API versions 1.0.0 through 4.1.7 Description: The issue arises from the news MonkeyC operation code in the CIQ API, which fails to properly check string resources, allowing them to extend past the expected sections. A malicious CIQ...

PT-2023-4482

Name of the Vulnerable Software and Affected Versions Openfire versions 3.10.0 through 4.6.7 Openfire versions 4.7.0 through 4.7.4 Description The administrative console of Openfire, a web-based application, is susceptible to a path traversal attack via the setup environment. This occurs because...

Johnson Controls OpenBlue Enterprise Manager Data Collector

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: OpenBlue Enterprise Manager Data Collector Vulnerabilities: Improper Authentication, Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION...

PT-2023-23744 · Teltonika · Teltonika Rut

Name of the Vulnerable Software and Affected Versions: Teltonika RUT router firmware versions 00.07.00 through 00.07.03 Description: The issue is an operating system OS command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a...