Relyum RELY-PCIe 安全漏洞

Relyum RELY-PCIe is a smart pluggable board from Relyum Spain. A security vulnerability exists in the Relyum RELY-PCIe versions v22.2.1 through v23.1.0 that stems from not setting the security attributes of sensitive cookies in an HTTPS session, which could result in a user agent sending these...

Controller 6000和Controller 7000 安全漏洞

The Gallagher Controller 6000 and Gallagher Controller 7000 are both products of Gallagher New Zealand.The Gallagher Controller 6000 is an interface between a Gallagher Command Center server and distributed field hardware. The Gallagher Controller 7000 is a powerful network connected controller. ...

CVE-2024-45596 Directus's session is cached for OpenID and OAuth2 if `redirect` is not used

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId...

PT-2024-29882 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP2 Description: A vulnerability has been identified in the SINEMA Remote Connect Server where the application does not properly handle user session establishment and invalidation. This coul...

Therapy Sessions Exposed by Mental Health Care Firm’s Unsecured Database

Video and audio of therapy sessions, transcripts, and other patient records were accidentally exposed in a publicly accessible database operated by the virtual medical company Confidant Health...

CVE-2023-52887

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtprxrtssessionnew This patch enhances error handling in scenarios with RTS Request to Send messages arriving closely. It replaces the less informative...

GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server

Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server...

How to enhance the security of your social media accounts

TL;DR Strong passwords : Use a password manager. Multi-factor authentication MFA : MFA requires multiple forms of identification, adding an extra layer of security. This makes it harder for unauthorised users to gain access even if they have your password. Phishing awareness : Stay alert to...

How AitM Phishing Attacks Bypass MFA and EDR—and How to Fight Back

Attackers are increasingly using new phishing toolkits open-source, commercial, and criminal to execute adversary-in-the-middle AitM attacks. AitM enables attackers to not just harvest credentials but steal live sessions, allowing them to bypass traditional phishing prevention controls such as MF...

PT-2024-26329 · Ibm · Ibm Security Verify Access

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0 through 10.0.8 Description: The issue allows a remote authenticated attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a...

Citrix DAAS: After creating machine Catalog, VDAs gets deleted after Turning them ON in Azure

After creating Machine Catalog and Delivery Group, VDAs would get deleted after turning them ON in Azure. These happens to Windows 11 Single and Multi session VDAs Error: FailureMessage: Error starting machine. At least one resource deployment operation failed...

CVE-2024-39836

Mattermost server vulnerable versions: 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x

CVE-2024-45163

The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC command and control server. Unauthenticated sessions remain open, causing resource consumption. For example, an attacker can send a recognized username such as root, or can send arbitrary data...

CVE-2024-45163

The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC command and control server. Unauthenticated sessions remain open, causing resource consumption. For example, an attacker can send a recognized username such as root, or can send arbitrary data...

PT-2024-31475 · Unknown +1 · Matrix Libolm +1

Name of the Vulnerable Software and Affected Versions: Matrix libolm versions through 3.2.16 Description: An issue was discovered in Matrix libolm, where cache-timing attacks can occur due to the use of base64 when decoding group session keys. This vulnerability only affects products that are no...

PT-2024-28691 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.8.x through 9.8.2 Mattermost versions 9.9.x through 9.9.1 Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.10.x through 9.10.0 Description: The issue allows remote/synthetic users to create sessions or reset...

CVE-2024-45163

CVE-2024-45163 concerns the Mirai botnet codebase where simultaneous TCP connections to the CNC server are mishandled, leaving unauthenticated sessions open and allowing resource consumption. Affected: Mirai botnet (through 2024-08-19) with unauthenticated sessions that can be triggered by sendin...

Styx Stealer Creator's OPSEC Fail Leaks Client List and Profit Details

In what's a case of an operational security OPSEC lapse, the operator behind a new information stealer called Styx Stealer leaked data from their own computer, including details related to the clients, profit information, nicknames, phone numbers, and email addresses. Styx Stealer, a derivative o...

PT-2024-31446

Name of the Vulnerable Software and Affected Versions Mirai botnet versions prior to 2024-08-19 Description The Mirai botnet through 2024-08-19 exhibits improper handling of simultaneous TCP connections to the command and control CNC server. This allows unauthenticated sessions to remain open,...

CVE-2024-22281

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...