CVE-2024-32753

Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component...

CVE-2024-32753 TYCO Illustra Pro Gen 4 - JQuery version

Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component...

CVE-2024-32753

CVE-2024-32753 maps to a dependency on vulnerable JQuery versions prior to 3.5.0 in Johnson Controls Illustra Pro Gen 4 cameras (affected: SS016.05.03.01.0010 and earlier). The root cause is third‑party JQuery component vulnerability; impact targets confidentiality (and potentially integrity) wit...

Third-Party Dependency in Confluence Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.0.1 of Confluence Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation...

PT-2024-28723

Name of the Vulnerable Software and Affected Versions Red-DiscordBot versions prior to 3.5.10 Description A bug in Red's Core API may authorize a user to run a command even when that user doesn't have permissions to manage a channel. This issue affects 3rd-party cogs using the @commands.can manag...

Johnson Controls Illustra Pro Gen 4 Security Vulnerability

Johnson Controls Illustra Pro Gen 4 is a series of surveillance probes from Johnson Controls, Inc. A security vulnerability exists in Johnson Controls Illustra Pro Gen 4 Camera SS016.05.03.01.0010 and prior versions, which stems from a dependency on vulnerable third-party components...

15 vulnerabilities discovered in software development kit for wireless routers

Cisco Talos Vulnerability Research team recently discovered 15 vulnerabilities in the Realtek rtl819x Jungle software development kit used in some small and home office wireless routers. This SDK uses the discontinued, open-source Boa as its web server. Talos researchers discovered these...

Hacker Leaks Thousands of Microsoft and Nokia Employee Details

Hacker "888" leaks personal data of Nokia and Microsoft employees on Breach Forums. Data breaches at third-party contractors…...

Lessons Learned From Exposing Unusual XSS Vulnerabilities

Misunderstood browser APIs are often at the core of many web security issues. With the rapid expansion of web APIs, keeping up with security best practices can be challenging. In this post, we’ll explore a few common mistakes developers make that lead to modern XSS Cross-Site Scripting...

[R1] Stand-alone Security Patch Available for Tenable Security Center versions 6.2.1, 6.3.0 and 6.4.0: SC-202407.1

R1 Stand-alone Security Patch Available for Tenable Security Center versions 6.2.1, 6.3.0 and 6.4.0: SC-202407.1 Arnie Cabral Tue, 07/09/2024 - 08:33 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components PHP was found to contain...

Shopify says stolen customer data was taken in third-party breach

Shopify has denied a breach of its systems after a cybercriminal posted alleged Shopify customer details online. Shopify told BleepingComputer and other publications that the incident happened at a third party: "Shopify systems have not experienced a security incident. The data loss reported was...

GHSA-3V33-3WMW-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

PT-2024-28634 · Evmos · Evmos

Name of the Vulnerable Software and Affected Versions: Evmos versions prior to 19.0.0 Description: The issue allows a user to create a vesting account with a 3rd party account as funder without its permission. This is possible because the authorization checked in the code is for the...

USN-6877-1 libreoffice vulnerability

It was discovered that LibreOffice incorrectly performed TLS certificate verification when the LibreOfficeKit library is being used by third-party components. A remote attacker could possibly use this issue to obtain sensitive information...

CBL Mariner 2.0 Security Update: rpm-ostree (CVE-2022-31394)

The version of rpm-ostree installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-31394 advisory. - Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2...

[R1] Tenable Identity Exposure Version 3.59.5 Fixes Multiple Vulnerabilities

R1 Tenable Identity Exposure Version 3.59.5 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 07/02/2024 - 13:24 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, curl, envoy, nodeJS were found to conta...

The Secrets of Hidden AI Training on Your Data

While some SaaS threats are clear and visible, others are hidden in plain sight, both posing significant risks to your organization. Wing's research indicates that an astounding 99.7% of organizations utilize applications embedded with AI functionalities. These AI-driven tools are indispensable,...

Vulnerabilities fixed in Progress MOVEit

Progress has fixed vulnerabilities in MOVEit Transfer and MOVEit Gateway. During the vulnerability investigation, a vulnerability was also discovered in an unnamed Third-Party component in use by MOVEit Transfer. The vulnerabilities are located in the SFTP module of the affected applications and...

Was T-Mobile compromised by a zero-day in Jira?

A moderator of the notorious data breach trading platform BreachForums is offering data for sale they claim comes from a data breach at T-Mobile. The moderator, going by the name of IntelBroker, describes the data as containing source code, SQL files, images, Terraform data, t-mobile.com...

PCI DSS 4.0.1: New Clarifications on Client-Side Security – What You Need to Know

As a leading provider of web application and API security solutions, Imperva is committed to helping merchants, payment processors, and anyone seeking to comply with the latest PCI DSS requirements. We previously discussed the changes introduced in PCI DSS 4.0. This blog will cover the...