Local File Inclusion (LFI)

changedetectionio is vulnerable to local file inclusion LFI. The vulnerability is due to insufficient input validation and lack of proper security controls when handling file paths in WebDriver requests, allows the use of the source:file:///etc/passwd to bypass restrictions and access sensitive...

Google Chrome 跨站脚本漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome, which stems from the Navigation module containing a policy misenforcement issue. An attacker could exploit the vulnerability to bypass security restrictions...

Mind the Gap: How Surface Command Tackles Asset Visibility in Attack Surface Management

“Only 17% of organizations can clearly identify and inventory a majority 95% or more of their assets.” - Gartner Imagine the scenario: your organization has been exposed to a new zero-day vulnerability. You are responsible for Threat & Vulnerability Management TVM, you have asked your IT departme...

The Importance of Asset Context in Attack Surface Management.

This is the last of the four blogs Help, I can’t see! A Primer for Attack Surface Management Blog Series, The Main Components of an Attack Surface Management ASM Strategy, and Understanding your Attack Surface: Different Approaches to Asset Discovery covering the foundational elements of Attack...

A Sherlock Holmes Approach to Cybersecurity: Eliminate the Impossible with Exposure Validation

Sherlock Holmes is famous for his incredible ability to sort through mounds of information; he removes the irrelevant and exposes the hidden truth. His philosophy is plain yet brilliant: "When you have eliminated the impossible, whatever remains, however improbable, must be the truth." Rather tha...

Researchers Uncover OS Downgrade Vulnerability Targeting Microsoft Windows Kernel

A new attack technique could be used to bypass Microsoft's Driver Signature Enforcement DSE on fully patched Windows systems, leading to operating system OS downgrade attacks. "This bypass allows loading unsigned kernel drivers, enabling attackers to deploy custom rootkits that can neutralize...

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B, related to authentication errors, allows attackers to bypass security restrictions.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to authentication errors. Exploiting these vulnerabilities can allow attackers to bypass security restrictions remotely...

The Spanish National Security Framework (ENS) is Now Part of the Qualys Enterprise TruRisk™ Platform

The Spanish National Security Framework ENS, regulated by Royal Decree 311/2022 , is a mandatory framework designed to ensure an optimal level of security for the digital infrastructure of companies in the Spanish public sector and critical infrastructures. Its main objective is to establish a...

ASD’s ACSC, CISA, FBI, NSA, and International Partners Release Guidance on Principles of OT Cybersecurity for Critical Infrastructure Organizations

Today, the Australian Signals Directorate’s Australian Cyber Security Centre ASD’s ACSC—in partnership with CISA, U.S. government and international partners—released the guide Principles of Operational Technology Cybersecuritylink is external. This guidance provides critical information on how to...

Deep Dive into the Latest API Security Vulnerabilities in Envoy

Envoy has carved out a critical role in cloud-native computing, becoming increasingly prevalent as the default ingress controller for Kubernetes. This high-performance proxy, developed by Lyft and now part of the Cloud Native Computing Foundation’s arsenal, is integral for companies scaling up...

BIT-ENVOY-2024-45806 Potential manipulate `x-envoy` headers from external sources in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration ...

CVE-2024-45806

A vulnerability was found in Envoy that allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918...

CVE-2024-45806

CVE-2024-45806 affects Envoy, a cloud-native edge proxy. The vulnerability stems from Envoy’s default handling of internal RFC1918 addresses, which are trusted even if internal_address_config is empty. An external client could exploit this to manipulate headers (e.g., x-envoy headers), potentiall...

PT-2024-38739 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue was initially considered but further investigation showed it does not pose a security risk as it falls within the expected functionality and security controls of th...

Fraudulent Slack ad shows malvertiser’s patience and skills

In the past year alone, we have reported almost five hundred unique malvertising incidents related to Google search ads. While it can be difficult to attribute each incident to a specific threat actor, we usually notice similarities between campaigns. Some malvertisers go to great lengths to bypa...

The vulnerability of the industrial server for serial devices of Korenix JetPort, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the industrial server for serial devices of Korenix JetPort is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

The vulnerability of the industrial server for serial devices of Korenix JetPort, related to the lack of measures taken to clean data at the management level, allows attackers to circumvent existing security restrictions.

The vulnerability of the industrial server for serial devices of Korenix JetPort is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

CVE-2024-6348

Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima 2022 allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests...

CVE-2024-6348 Predictable seed generation after ECU reset

Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima 2022 allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests...

CVE-2024-6348

CVE-2024-6348 affects the Nissan Altima 2022 Blind Spot Protection Sensor ECU, specifically the UDS security access seed generation. The root cause is predictable seed generation, enabling an attacker to forecast the requested seeds and bypass security controls by repeatedly resetting the ECU and...