CVE-2024-23645 GLPI reflected XSS in reports pages

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12...

CVE-2024-23645 GLPI reflected XSS in reports pages

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12...

GLPI -- multiple vulnerabilities

GLPI team reports: GLPI 10.0.12 Changelog SECURITY - moderate Reflected XSS in reports pages CVE-2024-23645 SECURITY - moderate LDAP Injection during authentication CVE-2023-51446...

PT-2024-19996 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.12 Description: A malicious URL can be used to execute XSS on reports pages. This issue affects GLPI, a Free Asset and IT Management Software package. Recommendations: For versions prior to 10.0.12, upgrade to...

PT-2024-13653 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue allows SQL Injection in the aggregate report feature. There is no information provided about the estimated number of potentially affected devices worldwide or details...

CVE-2019-5129

creationtimestamp| type| source ---|---|--- 2024-01-29 09:41:40+00:00| seen| https://t.me/ctinow/175124 2024-11-30 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-11-30 2024-12-24 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities ...

CVE-2019-5127

creationtimestamp| type| source ---|---|--- 2024-01-29 09:41:37+00:00| seen| https://t.me/ctinow/175122 2024-05-22 06:15:17+00:00| seen| https://t.me/CyberSecurityTechnologies/2661 2024-12-22 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-12-22 2024-12-26...

kernel: HID: betop: check shape of output reports

In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopffinit only checks the total sum of the report counts for each report field to be at least 4, but hidbetopffplay expects 4 report fields. A device advertising an output report with o...

amministrazionicondominialiverona.it Improper Access Control vulnerability OBB-3838274

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-22877

StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...

CVE-2023-5914

creationtimestamp| type| source ---|---|--- 2024-01-17 22:27:02+00:00| seen| https://t.me/ctinow/169488 2024-02-06 08:41:18+00:00| seen| https://t.me/ctinow/179835 2024-03-16 08:53:38+00:00| seen| https://t.me/CNArsenal/2127 2024-03-16 19:41:57+00:00| seen|...

CVE-2024-22628

Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expensebudget/admin/?page=reports/budget&datestart=2023-12-28&dateend=...

CVE-2024-0232

creationtimestamp| type| source ---|---|--- 2024-01-16 15:26:32+00:00| seen| https://t.me/ctinow/168849 2024-01-24 17:16:54+00:00| seen| https://t.me/ctinow/172925 2024-01-30 14:41:49+00:00| seen| https://t.me/ctinow/175937 2024-03-15 11:26:41+00:00| seen| https://t.me/ctinow/208636 2024-11-14...

CVE-2024-22628

Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expensebudget/admin/?page=reports/budget&datestart=2023-12-28&dateend=...

PT-2024-19507 · Unknown · Budget/Expense Tracker System

Name of the Vulnerable Software and Affected Versions: Budget and Expense Tracker System version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the "/expense budget/admin/?page=reports/budget&date start=2023-12-28&date end=" endpoint. The date start and date end...

CVE-2024-21589

An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0...

Juniper Networks Paragon Active Assurance Security Vulnerability

Juniper Networks Paragon Active Assurance is a programmable test and service assurance solution from Juniper Networks, Inc. It can be easily used and delivered as a SaaS solution from the cloud or deployed locally in NFV environments using software-based and traffic-generating test proxies. A...

ThreatDown earns highest ratings across EDR and MDR categories in G2 Winter 2024 results

The peer-to-peer review source G2 has released its Winter 2024 reports, ranking ThreatDown products on top across several Endpoint Detection and Response EDR and Managed Detection and Response MDR categories. Based on verified customer reviews, ThreatDown EDR was voted a Leader in the overall and...

CVE-2024-0294

creationtimestamp| type| source ---|---|--- 2024-01-08 04:21:27+00:00| seen| https://t.me/ctinow/164200 2024-01-11 19:31:52+00:00| seen| https://t.me/ctinow/166753 2024-01-25 08:41:29+00:00| seen| https://t.me/ctinow/173326...

How AI hallucinations are making bug hunting harder

Bug bounty programs that pay people for finding bugs are a very useful tool for improving the security of software. But with the availability of artificial intelligence AI as seen in the popular large language models LLMs like ChatGPT, Bard, and others it looks like there is a new problem on the...