Brandon Adkins’ Career Journey - Taking Chances and Tackling New Challenges

Brandon Adkins is the Manager of our Threat Intelligence & Detection Engineering TIDE team. His career journey spans a variety of roles and teams where he has been able to showcase his technical skills in security. Since joining Rapid7, he’s had experience as a Penetration Testing Consultant,...

CISA Releases Eleven Industrial Control Systems Advisories

CISA released eleven Industrial Control Systems ICS advisories on August 15, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-228-01 Siemens SCALANCE M-800, RUGGEDCOM RM1224 ICSA-24-228-02 Siemens INTRALOG WMS...

sma.org Cross Site Scripting vulnerability OBB-3956858

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

prabhupadabooks.com Cross Site Scripting vulnerability OBB-3956776

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Rogue AI is the Future of Cyber Threats

This is the first blog in a series on Rogue AI. Later articles will include technical guidance, case studies and more...

rpc.edu.bd Cross Site Scripting vulnerability OBB-3956757

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

secure2.wish.org Cross Site Scripting vulnerability OBB-3956748

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

scib.com.my Cross Site Scripting vulnerability OBB-3956738

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-7347

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and the mp4 directi...

ALPINE-CVE-2024-7347

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and the mp4 directi...

CVE-2024-39809

The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-7347

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and the mp4 directi...

CVE-2024-41719

CVE-2024-41719 affects BIG-IP Next Central Manager. When generating a QKView file of a BIG-IP Next instance from Central Manager, F5 iHealth credentials are logged in the BIG-IP Central Manager logs. The vulnerability is scoped to BIG-IP Next Central Manager (20.1.0–20.2.0 are listed as vulnerabl...

CVE-2024-41723 BIG-IP iControl REST vulnerability

Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

SQL Injection Vulnerability in Enterprise Standardization Management System of R&S Standardization Technical Services (Shanghai) Co.

R&S Standardization Technical Services Shanghai Co. A SQL injection vulnerability exists in the Enterprise Standardization Management System of R&S Standardization Technical Services Shanghai Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

PT-2024-29535 · F5 · F5 Big-Ip Next

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP Next affected versions not specified Description: When generating a QKView of a BIG-IP Next instance from the BIG-IP Next Central Manager, F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note that software...

sekarlaut.com Cross Site Scripting vulnerability OBB-3956325

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

July 9, 2024—KB5040456 (Monthly Rollup)

None None...

AVEVA SuiteLink Server

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : AVEVA Equipment : SuiteLink Server Vulnerability : Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

findafacilitator.com Cross Site Scripting vulnerability OBB-3955234

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...