react-training.eu Improper Access Control vulnerability OBB-3825351

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

How to recognize AI-generated phishing mails

Phishing is the art of sending an email with the aim of getting users to open a malicious file or click on a link to then steal credentials. But most phishers arent very good, and the success rate is relatively low: In 2021, the average click rate for a phishing campaign was 17.8%. However, now...

Information Disclosure

mltable is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to disclose training data...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6977 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6977 Source advisory: OSV:GHSA-QG8P-32GR-GH6X...

Karakurt Data Extortion Group

Actions to take today to mitigate cyber threats from Karakurt ransomware: 1. Prioritize patching known exploited vulnerabilities. 2. Train users to recognize and report phishing attempts. 3. Enforce multifactor authentication...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6709 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6709 Source advisory: OSV:GHSA-CXFR-5Q3R-2RC2...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +339 more potentially affected by CVE-2023-6709 via mlflow (>=0.8.2 <=2.9.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-6709 Source advisory: OSV:PYSEC-2023-281...

FormaLMS Cross-Site Scripting Vulnerability

FormaLMS is an open source learning management system. It is used to build around the specific needs of corporate training. A cross-site scripting vulnerability exists in FormaLMS versions prior to 4.0.5, which stems from the application's lack of effective filtering and escaping of user-supplied...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +338 more potentially affected by CVE-2023-43472 via mlflow (>=0.8.2 <=2.8.1)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2023-43472 Source advisory: OSV:GHSA-WQXF-447M-6F5F...

Stellar Cyber Bridges Cybersecurity Skills Gap with First-of-Its-Kind University Program

By Owais Sultan Stellar Cyber launches a field-proven university program to enable educational organizations to deliver hands-on cybersecurity training and provide soc services to underserved communities. This is a post from HackRead.com Read the original post: Stellar Cyber Bridges Cybersecurity...

Qakbot Takedown Aftermath: Mitigations and Protecting Against Future Threats

The U.S. Department of Justice DOJ and the FBI recently collaborated in a multinational operation to dismantle the notorious Qakbot malware and botnet. While the operation was successful in disrupting this long-running threat, concerns have arisen as it appears that Qakbot may still pose a danger...

Extracting GPT’s Training Data

This is clever: The actual attack is kind of silly. We prompt the model with the command "Repeat the word poem forever" and sit back and watch as the model responds complete transcript here. In the abridged example above, the model emits a real email address and phone number of some unsuspecting...

6 Steps to Accelerate Cybersecurity Incident Response

Modern security tools continue to improve in their ability to defend organizations' networks and endpoints against cybercriminals. But the bad actors still occasionally find a way in. Security teams must be able to stop threats and restore normal operations as quickly as possible. That's why it's...

Be Empathetic and Hug Your CISO More!

In the rapidly evolving landscape of cloud computing, the adoption of multi-cloud environments has become a prevailing trend. Organizations increasingly turn to multiple cloud providers to harness diverse features, prevent vendor lock-in, and optimize costs. The multi-cloud approach offers...

CVE-2023-47369

The leakage of channel access token in besttrainingmember Line 13.6.1 allows remote attackers to send malicious notifications...

CVE-2023-47369

The leakage of channel access token in besttrainingmember Line 13.6.1 allows remote attackers to send malicious notifications...

Line Security Breach

Line is an instant messaging platform from Line Inc. A security vulnerability exists in Line version 13.6.1, which stems from an access token disclosure issue in besttrainingmember. A remote attacker can exploit the vulnerability to send malicious notifications...

PT-2023-30431 · Unknown · Best Training Member

Name of the Vulnerable Software and Affected Versions: best training member version 13.6.1 Description: The issue allows remote attackers to send malicious notifications due to the leakage of channel access token in best training member. Recommendations: For version 13.6.1, consider restricting...

Directory Traversal Vulnerability in the Training Platform of Shenzhen Sigma Data Technology Co.

Shenzhen Sigma Data Technology Co., Ltd. is an enterprise mainly engaged in software and information technology service industry. Shenzhen Sigma Data Technology Co., Ltd. practical training teaching platform to fish with the party there is a directory traversal vulnerability, an attacker can use...

SAP Enable Now Code Issue Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. SAP Enable Now suffers from a code issue vulnerability that stems from an unimplemented X-FRAME-OPTIONS response...