Qualys Launches Enterprise TruRisk™ Management: The Industry’s First Cloud-Based Risk Operations Center

In today’s complex cybersecurity landscape, Chief Information Security Officers CISOs and business leaders require more than just a collection of disconnected tools to manage risks effectively—they need a unified, integrated approach. Today, we proudly announce the launch of Qualys Enterprise...

The Future of Cybersecurity Risk Management: Risk Operations Center (ROC) delivered by Qualys Enterprise TruRisk™ Management (ETM)

" A problem well defined is a problem half solved." – Charles Kettering In today’s digital landscape, organizations are overwhelmed with risk signals from all directions—cloud vulnerabilities, misconfigurations in custom code, operational technology OT gaps, and third-party integrations, to name ...

AI girlfriend site breached, user fantasies stolen [updated]

A hacker has stolen a massive database of users’ interactions with their sexual partner chatbots, according to 404 Media. The breached service, Muah.ai, describes itself as a platform that lets people engage in AI-powered companion NSFW chat, exchange photos, and even have voice chats. As you can...

编号撤回

RedSys 3DSecure is a payment security technology from RedSys, Spain, designed to improve the security of online transactions, especially during credit and debit card payments. This CVE number has been withdrawn...

Rockwell Automation Verve Asset Manager 安全漏洞

Rockwell Automation Verve Asset Manager is a vendor-neutral OT endpoint management platform from Rockwell Automation. A security vulnerability exists in Rockwell Automation Verve Asset Manager versions prior to V1.38 that stems from the presence of an improper authorization vulnerability that cou...

Security Bulletin: CVE-2023-22045, CVE-2023-22049 affects IBM® SDK, Java™ Technology Edition affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition in version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. An update has been released to address the vulnerability. Vulnerability Details CVEID:CVE-2023-22045...

XSS vulnerability in jpress of Guizhou Small Code Technology Co. Ltd (CNVD-2024-46157)

jpress is a CMS system developed using Java. Guizhou Small Code Technology Co. jpress has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

Plus: Harvard students pack Meta’s smart glasses with privacy-invading face-recognition tech, Microsoft and the DOJ seize Russian hackers’ domains, and more...

Apple Releases Critical iOS and iPadOS Updates to Fix VoiceOver Password Vulnerability

Apple has released iOS and iPadOS updates to address two security issues, one of which could have allowed a user's passwords to be read out aloud by its VoiceOver assistive technology. The vulnerability, tracked as CVE-2024-44204, has been described as a logic problem in the new Passwords app...

CVE-2024-44439

CVE-2024-44439 concerns Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v1.9.1. The available sources describe a vulnerability that could allow a remote attacker to escalate privileges via an open port. Affected component/version: ...

Security Bulletin: IBM Sterling Control Center v6.2.x and v6.3.x are vulnerable due to IBM SDK Java Technology Edition vulnerability

Summary IBM SDK, Java Technology Edition Quarterly CPU - Oct 2023 - Includes Oracle October 2023 CPU plus CVE-2023-5676, CVE-2023-22081, CVE-2023-22067 affecting Sterling Control Center v6.2.x and v6.3.x. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle July 2024 Critical Patch Update. Vulnerability Details CVEID: CVE-2024-21011 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impact. CVSS...

INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa

INTERPOL has announced the arrest of eight individuals in Côte d'Ivoire and Nigeria as part of a crackdown on phishing scams and romance cyber fraud. Dubbed Operation Contender 2.0, the initiative is designed to tackle cyber-enabled crimes in West Africa, the agency said. One such threat involved...

Vulnerability of loading and downloading functions for microprogramming software of PLANET Technology devices, allowing attackers to bypass authentication processes and execute arbitrary code.

The vulnerability of the loading and downloading functions of microprogramming software from PLANET Technology is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and execute arbitrary code...

CVE-2024-24122

A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip compressed file to construct a special file name, which can be used to decompress the project file into the system startup folder, restar...

CVE-2024-24122

CVE-2024-24122 describes a remote code execution in Wanxing Technology’s Yitu project management. A crafted exp.adpx file is treated as a zip archive with a special filename, enabling decompression of the project file into the system startup folder, followed by a system restart and automatic exec...

CVE-2024-24122

A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip compressed file to construct a special file name, which can be used to decompress the project file into the system startup folder, restar...

PT-2024-20282 · Wanxing Technology · Yitu

Name of the Vulnerable Software and Affected Versions: Wanxing Technology's Yitu project affected versions not specified Description: A remote code execution issue exists in the project management of Wanxing Technology's Yitu project. This allows an attacker to use the exp.adpx file as a zip...

Security Bulletin: Multiple security vulnerabilities in IBM SDK, Java Technology Edition affects IBM OpenPages

Summary IBM® SDK, Java™ Technology Edition is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM SDK, Java Technology Edition has been published in multiple security bulletins. These products have addressed the applicable CVEs. For a complet...

ASD’s ACSC, CISA, FBI, NSA, and International Partners Release Guidance on Principles of OT Cybersecurity for Critical Infrastructure Organizations

Today, the Australian Signals Directorate’s Australian Cyber Security Centre ASD’s ACSC—in partnership with CISA, U.S. government and international partners—released the guide Principles of Operational Technology Cybersecuritylink is external. This guidance provides critical information on how to...