CVE-2024-3689: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403. Affected is an unknown function of the file /xportalassemblesurface/jaxrs/portal/list?v=8.2.3-4-43f4fe3. The manipulation leads to information disclosure. It is possible to...

Apple Updates Spyware Alert System to Warn Victims of Mercenary Attacks

Apple on Wednesday revised its documentation pertaining to its mercenary spyware threat notification system to mention that it alerts users when they may have been individually targeted by such attacks. It also specifically called out companies like NSO Group for developing commercial surveillanc...

Command Execution Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-23166)

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. A command execution vulnerability exists in the electronic document security management system of Beijing Yisetong Technology Development Co., Lt...

Logic flaw vulnerability in KingH5Stream of Beijing Asian Control Technology Development Co. Ltd (CNVD-2024-23408)

Beijing Asian Control Technology Development Co., Ltd. is an industrial automation and informationization software platform high-tech enterprise founded in 1997, headquartered in Beijing, China, focusing on domestic industrial software independent research and development, marketing and services...

Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers

On April 9, Twitter/X began automatically modifying links that mention "twitter.com" to read "x.com" instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links -- such as fedetwitter.com,...

Palo Alto Networks PAN-OS 8.1.x < 8.1.24 / 9.0.x < 9.0.17 / 9.1.x < 9.1.15-h1 / 10.0.x < 10.0.12 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.24 or 9.0.x prior to 9.0.17 or 9.1.x prior to 9.1.15-h1 or 10.0.x prior to 10.0.12. It is, therefore, affected by a vulnerability. - A vulnerability in Palo Alto Networks PAN-OS software enables a remote...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-22036, CVE-2023-22006, CVE-2023-22041, CVE-2023-22049 and CVE-2023-22045)

Summary Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2023-22036 DESCRIPTION: An unspecified vulnerability in Java SE related to the Utility component could allow a remo...

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM TXSeries for Multiplatforms (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM TXSeries for Multiplatforms CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049. An update to IBM TXSeries for Multiplatforms has been released to address these...

SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2024:1102-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1102-1 advisory. - CVE-2023-28746: Register File Data Sampling bsc1221332 - CVE-2024-2193: Fixed GhostRace, a...

Command Execution Vulnerability in EG2000CE of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-22811)

The EG2000CE is a smart router. A command execution vulnerability exists in the EG2000CE of Beijing StarNet Ruijie Network Technology Company Limited, which can be exploited by an attacker to gain server privileges...

KingPortal Development System Client Logic Flaw Vulnerability of Beijing Asia Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of automation software platform. Beijing Asian Control Technology Development Co., Ltd. KingPortal development system client there is a logic flaw vulnerability, the attacker can use the vulnerability through the...

SQL Injection Vulnerability in Active Security Monitoring Cloud Platform of Dongguan Tongtianxing Software Technology Co.

Dongguan Tongtianxing Software Technology Co., Ltd. focuses on providing platform services for positioning and wireless video terminal products, and the company has core technology and independent research and development capabilities. Dongguan Tongtianxing Software Technology Co., Ltd. active...

Checkmk Privilege Escalation

The vulnerability of Checkmk, a monitoring software for IT infrastructure, is related to an uncontrollable element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-22743)

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. A SQL injection vulnerability exists in the Data Leakage Protection DLP system of Beijing Yisetong, which can be exploited by attackers to obtain...

CVE-2024-30265

The voilà dashboard (part of Collabora Online) is vulnerable to Local File Inclusion (LFI) . The root cause is an oversight where the static_path is set to "/" regardless of the --static CLI option, causing the tornado.web.StaticFileHandler to permit access to the entire filesystem. An attacker w...

Weak password vulnerability in InVid Tech of Shenzhen Tongwei Digital Technology Co.

Shenzhen Tongwei Digital Technology Co., Ltd. is a research and development, production, sales and service in one of the video security field of international - streaming products and system solutions provider. Shenzhen Tongwei Digital Technology Co., Ltd InVid Tech There is a weak password...

SQL Injection Vulnerability in Crypto M8 Integration Management Platform of Xiamen Crypto Information Technology Co.

Founded in 2007, Xiamen Crypto Information Technology Co., Ltd. is a vendor specializing in the development of integration management software. A SQL injection vulnerability exists in the Crypto M8 Integration Management Platform of Xiamen Crypto Information Technology Co. Ltd, which can be...

Command Execution Vulnerability in EG3210 of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-23199)

The EG3210 is a multi-service security gateway. A command execution vulnerability exists in the EG3210, which can be exploited by an attacker to gain control of a server...

Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to unspecified vulnerabilities and sensitive information exposure due to IBM Runtime Environment Java Technology Edition Version 8

Summary IBM Java 8 is used by IBM Sterling Connect:Direct for UNIX in product configuration, management, and data transmission. IBM Sterling Connect:Direct for UNIX is impacted by unspecified vulnerabilities and sensitive information exposure due to IBM Java 8. IBM Sterling Connect:Direct for UNI...

Challenges Drive Career Growth: Meet Rudina Tafhasaj

Starting a career for the first time in a new country can be intimidating. For Rudina Tafhasaj, her path to Senior Application Engineer at Rapid7 was paved with both unique challenges, and incredible rewards. Growing up, Rudina was inspired to get into technology by her older brother. “He loved...