PT-2026-4683

In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

Security Bulletin: IBM Global Availability Mailbox is affected by a Bouncy Castle vulnerability that could allow a remote attacker to obtain sensitive information (CVE-2023-33201)

Summary IBM Global Availability Mailbox is affected by the Bouncy Castle Crypto Package For Java bc-java it could allow a remote attacker to obtain sensitive information, caused by not validating the X.500 name of any certificate in the implementation of the X509LDAPCertStoreSpi.java class. By...

Preparing for PCI DSS 4.0

PCI DSS 4.0 is currently in its request for comments RFC process, where the industry can provide comments and feedback to help shape the next iteration. This process is initially open to the participating organizations - members that help steer and inform the PCI SSC based on their experiences. T...

Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting

Zoho ManageEngine ADSelfService Plus 5.7 &searchType=contains&searchBy=ALLFIELDS&actionId=Search HTTP/1.1 &adscsrf= 4- Stored XSS in self-update layout implementation. /SelfService.do?meth...

ghostscript sandbox bypass remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

! 0x00 vulnerability background 11 on the 21st, Semmle team of security researchers Man Yue Mo by semmle website, once again that ghostscript security sandbox can be bypassed by constructing a malicious PDF content that can cause remote command execution. ghostscript is widely used, ImageMagick,...

Cambium ePMP 1000 - Multiple Vulnerabilities

July 14, 2015: First contacted Cambium July 14, 2015: Initial vendor response July 16, 2015: Vuln Details reported to Cambium July 31, 2015: Followup on advisory and fix timelines August 03, 2015: Vendor gives mid-Aug as fix v2.5 release timeline. Ceases communication. Nov 19, 2015: Releasing...