HP ThinUpdate Trust Management Issue Vulnerability

HP ThinUpdate is an application from Hewlett-Packard HP USA. It allows you to download system images and software add-ons from HP, capture HP Thin Client images, create ISO files, and more! A security vulnerability exists in the HP ThinUpdate utility HP Recovery Image and Software Download Tool,...

Huawei HarmonyOS Trust Management Issue Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a trust management issue vulnerability, which stems from the presence of a package name public key that is not verified in the...

Cisco Emergency Responder Trust Management Issues Vulnerability

Cisco Emergency Responder is an emergency response framework from Cisco USA. A trust management issue vulnerability exists in Cisco Emergency Responder version 12.51SU4, which arises from the presence of static user credentials for the root account, which are typically used during development, an...

Front-Running during Proxy Creation

Lines of code Vulnerability details Impact An ill-intentioned party might front run every proxy contracts creation and deploy one first causing the transaction for every user to revert. It is worth noting that for this attack to succeed, the attacker would need to get their transaction mined in t...

hw: Intel: Unauthorized error injection in Intel SGX or Intel TDX

A flaw was found in hw. Unauthorized error injection in IntelR SGX or IntelR TDX for some IntelR XeonR processors may allow a privileged user to potentially enable escalation of privilege via local access...

Elon Musk Is Personally Undermining X’s Efforts to Curb Israel-Hamas War Disinformation

X’s Trust and Safety team says it’s working to remove false information related to the Israel-Hamas war. Meanwhile, Elon Musk is sharing conspiracies and chatting with QAnon promoters...

Code injection

OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract da...

PYSEC-2023-195

OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract da...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a trust management issue vulnerability, which stems from the presence of a package name public key that is not verified in the...

JetBrains Ktor Trust Management Issues Vulnerability

The JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A trust management issue vulnerability exists in JetBrains Ktor versions prior to 2.3.5, which stems from a failure to validate server certificates, resulting in a trust management issue vulnerability...

Heimdal: Multiple Vulnerabilities

Background Heimdal is a free implementation of Kerberos 5. Description Multiple vulnerabilities have been discovered in Heimdal, the worst of which could lead to remote code execution on a Kerberos Domain Controller. Please review the CVE identifiers referenced below for details. Impact Please...

keycloak: Untrusted Certificate Validation

A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If...

Achieving DORA Compliance with Qualys: A Comprehensive Approach

In the ever-changing landscape of finance and technology, it is crucial to have robust operational resilience and compliance frameworks. The Digital Operational Resilience Act DORA framework is a significant step in this direction, as it is intended to strengthen the resilience of financial...

sustainablefoodtrust.org Cross Site Scripting vulnerability OBB-3721492

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Qognify NiceVision Trust Management Issue Vulnerability

Qognify NiceVision is a comprehensive, open platform IP video surveillance solution from Qognify. providing surveillance coverage and control for security-conscious environments. Qognify NiceVision 3.1 and prior versions suffer from a trust management issue vulnerability that stems from the use o...

Cisco Emergency Responder 信任管理问题漏洞

Cisco Emergency Responder is an emergency response framework from Cisco USA. A trust management issue vulnerability exists in Cisco Emergency Responder version 12.51SU4, which arises from the presence of static user credentials for the root account, which are typically used during development, an...

CVE-2023-44463

CVE-2023-44463 affects pretix versions before 2023.7.1. The issue arises from incorrect parsing of configuration files, causing the application to trust unchecked X-Forwarded-For headers even when not configured to do so. This can enable IP address spoofing by users of the application and may aff...

Microweber Trust Management Issues Vulnerabilities

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A vulnerability with trust management issues exists in Microweber versions prior to 2.0,...

NSA, FBI, CISA, and Japanese Partners Release Advisory on PRC-Linked Cyber Actors

Today, the U.S. National Security Agency NSA, Federal Bureau of Investigation FBI, and Cybersecurity and Infrastructure Security Agency CISA, along with the Japan National Police Agency NPA and the Japan National Center of Incident Readiness and Strategy for Cybersecurity NISC released joint...

People's Republic of China-Linked Cyber Actors Hide in Router Firmware

Executive Summary The United States National Security Agency NSA, the U.S. Federal Bureau of Investigation FBI, the U.S. Cybersecurity and Infrastructure Security Agency CISA, the Japan National Police Agency NPA, and the Japan National Center of Incident Readiness and Strategy for Cybersecurity...