CVE-2024-37386: Improper Access Control

An issue was discovered in Stormshield Network Security SNS 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in single-user mode despite the activation of secure boot. The following versions fix this: 4.3.27, 4.7.6, and 4.8.2...

CVE-2024-37386

An issue exists in Stormshield Network Security (SNS) versions 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Due to improper access control , certain manipulations allow the system to be restarted in single-user mode even when secure boot is active. To resolve this, users should update to...

Stormshield Network Security Security Vulnerabilities

Stormshield Network Security SNS is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability exists in Stormshield Network Security SNS versions 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0, which originates from the fact that...

Citrix Daas - Authentication

Introduction This article is a summary of the top support articles and Product Documents related to Citrix DaaS Authentication Methods. The most commonly used support articles and guides are below. It is recommended that all customers refer to the product documentation for configuration related...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

Cosmic Sting: CVE-2024-34102 Exploiter Cosmic Sting is a Go-b...

How to Configure NetScaler and StoreFront for Internal and External Connections

This article describes how to configure NetScaler and StoreFront with two NetScaler Gateways, two StoreFront sites, two different subnet IPs, and one URL for both internal and external connections...

UBUNTU-CVE-2024-40909

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free in bpflinkfree After commit 1a80dbcb2dba, bpflink can be freed by link-ops-deallocdeferred, but the code still tests and uses link-ops-dealloc afterward, which leads to a use-after-free as...

WordPress plugin Media Hygiene security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Directus Allows Single Sign-On User Enumeration

Impact When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user...

Pen testing cruise ships

New build ships contracted for build from 1st July 2024 must comply with IACS UR E26 & 27. What does this mean for assessing the cyber security of a cruise ship? What’s the risk profile? Cruise ships have a unique risk profile. This is due to the huge number of guests on board, highly complex...

Directus Security Vulnerabilities

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 10.12.0. An attacker exploited the vulnerability to overwhelm the server by requesting the same field multiple times in a single query...

Directus Security Vulnerabilities

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus. An attacker exploiting this vulnerability could enumerate existing SSO users in an instance...

SUSE CVE-2022-48713

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix crash with stop filters in single-range mode Add a check for !buf-single before calling ptbufferregionsize in a place where a missing check can cause a kernel crash. Fixes a bug introduced by commit...

CVE-2024-3826

CVE-2024-3826 concerns Akana. Based on the provided documents, affected software is Akana where validation is broken when using the SAML Single Sign-On (SSO) functionality, for versions prior to and including 2022.1.3. The root cause is a broken validation process in the SAML SSO flow, but the co...

CVE-2024-3826 Broken SAML Validation

In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On SSO functionality...

CVE-2024-3826 Broken SAML Validation

In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On SSO functionality...

PT-2024-27907

Name of the Vulnerable Software and Affected Versions Akana versions prior to and including 2022.1.3 Description The validation is broken when using the SAML Single Sign-On SSO functionality. Recommendations For versions prior to and including 2022.1.3, consider disabling the SAML Single Sign-On...

CVE-2024-3826: Improper Authentication

In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On SSO functionality...

Akana Security Breach

Akana is an interface management platform from Akana Corporation. A security vulnerability exists in Akana versions prior to 2022.1.3 that stems from authentication breaking when using the SAML Single Sign-On SSO feature...

Kiloview P1 and P2 Security Vulnerabilities

Kiloview P1 4G Video Encoder and Kiloview P2 4G Video Encoder are both professional video encoder devices from China-based Kiloview. A security vulnerability exists in the Kiloview P1 and P2 that originates from a user account that allows the creation of weak passwords, including single-character...