CVE-2024-51713

CVE-2024-51713 is a reflected XSS vulnerability in HQ60 Fidelity Card (TRe Technology And Research S.R.L) plugin. Affected: HQ60 Fidelity Card from n/a to 1.8. Reported CVSS 3.1 (7.1, HIGH) with NETWORK attack vector, UI interaction required. No explicit mitigation or fix details are provided in ...

Exploit for Missing Authentication for Critical Function in Fortinet Fortimanager

CVE-2024-47575 Fortinet FortiManager Unauthenticated Remote Co...

Introducing the next generation of AI-powered remediation: Choose your own remediation strategy

The new AI-powered remediation 2.0 combines the power of GenAI with the Wiz Research Team’s expertise in identifying cloud-native attack paths...

How LLMs could help defenders write better and faster detection

Most users will associate large language models LLMs like ChatGPT with answering basic questions or helping to write basics lines of text. But could these tools actually help defenders in the cybersecurity industry write more effective detection content? Several security researchers from across...

Apple Opens PCC Source Code for Researchers to Identify Bugs in Cloud AI Security

Apple has publicly made available its Private Cloud Compute PCC Virtual Research Environment VRE, allowing the research community to inspect and verify the privacy and security guarantees of its offering. PCC, which Apple unveiled earlier this June, has been marketed as the "most advanced securit...

Exploit for Improper Restriction of XML External Entity Reference in Python

CVE-2022-48565 PoC Introduction This is a Proof of Concep...

Exploit for Missing Release of Memory after Effective Lifetime in Linux Linux_Kernel

CVE-2022-48565 PoC Introduction This is a Proof of Concep...

LangChain < 0.2.9 SSRF

The remote host contains a langchain version that is prior to 0.2.9. It is, therefore, affected by a Server-Side Request Forgery vulnerability in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises...

What I’ve learned in my first 7-ish years in cybersecurity

When I first interviewed with Joel Esler for my position at Cisco Talos, I remember when the time came for me to ask questions, one thing stood out. I asked what resources were available to me to learn about cybersecurity, because I was totally new to the space. His answer: The people. When I ask...

23andMe will retain your genetic information, even if you delete the account

Deleting your personal data from 23andMe is proving to be hard. There are good reasons for people wanting to delete their data from 23andMe: The DNA testing platform has a lot of problems, so let’s start with a recap. A little over a year ago, cybercriminals put up information belonging to as man...

SAS CTF and the many ways to persist a kernel shellcode on Windows 7

On May 18, 2024, Kaspersky's Global Research & Analysis Team GReAT, with the help of its partners, held the qualifying stage of the SAS CTF, an international competition of cybersecurity experts held as part of the Security Analyst Summit conference. More than 800 teams from all over the world to...

New Telekopye Scam Toolkit Targeting Booking.com and Airbnb Users

ESET Research found the Telekopye scam network targeting Booking.com and Airbnb. Scammers use phishing pages via compromised accounts…...

CVE-2024-7847

VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a...

CVE-2024-7847 RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script

VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a...

CVE-2024-7847 RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script

VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a...

Deebot Robot Vacuums Are Using Photos and Audio to Train Their AI

An Australian news agency is reporting that robot vacuum cleaners from the Chinese company Deebot are surreptitiously taking photos and recording audio, and sending that data back to the vendor to train their AIs. Ecovacs's privacy policy--available elsewhere in the app--allows for blanket...

Exploit for OS Command Injection in Paloaltonetworks Expedition

CVE-2024-9464: Palo Alto Expedition Authenticated Command Inje...

Exploit for SQL Injection in Paloaltonetworks Expedition

CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Inject...

Exploit for Classic Buffer Overflow in Microsoft

EN GenWebDavIISExploit is a PoC tool demonstrating an expl...

Agnai vulnerable to Relative Path Traversal in Image Upload

Summary A vulnerability has been discovered in Agnai that permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for...