Aggregator

A vulnerability classified as critical has been found in Best Courier Management System 1.0. Affected is an unknown function. The manipulation of the argument userID leads to Privilege Escalation. This vulnerability is traded as CVE-2023-46980. It is possible to launch the attack remotely. There is no exploit available.

via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!

Permalink

The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #305 – Two Full Days on Big Room Planning appeared first on Security Boulevard.

A vulnerability classified as critical was found in Kolayindir Download. This vulnerability affects unknown code of the file down.asp. The manipulation of the argument id leads to sql injection. This vulnerability was named CVE-2007-0140. The attack can be initiated remotely. Furthermore, there is an exploit available.

Eaten by a GRU: Fake ransomware created by Russian GRU Unit 29155 attacked Ukraine and NATO—a month before the full scale invasion.

The post Russian ‘WhisperGate’ Hacks: 5 More Indicted appeared first on Security Boulevard.

A vulnerability was found in Grassapper Slideshow 365 3.6. It has been declared as critical. This vulnerability affects unknown code of the component X.509 Certificate Handler. The manipulation leads to cryptographic issues. This vulnerability was named CVE-2014-5917. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability was found in ShoutPro 1.5.2 and classified as critical. Affected by this issue is some unknown functionality of the file shoutbox.php. The manipulation of the argument shout leads to Remote Code Execution. This vulnerability is handled as CVE-2007-2141. The attack may be launched remotely. Furthermore, there is an exploit available.

The Biden administration launches an initiative to encourage careers in cybersecurity, as businesses try new tactics to get unfilled IT security roles staffed.

A vulnerability has been found in Lexmark X94x and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to memory corruption. This vulnerability is known as CVE-2010-0619. The attack can be launched remotely. Furthermore, there is an exploit available.

You can now test the security of persisted GraphQL Queries with Escape's platform. This new capability enhances our GraphQL API security testing

The post Product Updates: Persisted GraphQL Query Support appeared first on Security Boulevard.

A vulnerability classified as critical was found in tcpdump up to 4.9.1. This vulnerability affects the function bgp_attr_print of the file print-bgp.c of the component BGP Parser. The manipulation leads to memory corruption. This vulnerability was named CVE-2017-12991. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

​After Office 2024 launches in October, Microsoft will disable ActiveX controls by default in Word, Excel, PowerPoint, and Visio client apps. [...]

A vulnerability classified as critical was found in D-Link DI-8100G 17.12.20A1. Affected by this vulnerability is the function sub47A60C of the file upgrade_filter.asp. The manipulation leads to command injection. This vulnerability is known as CVE-2024-44401. The attack can be launched remotely. There is no exploit available.

A vulnerability classified as critical has been found in Red Hat Migration Toolkit for Virtualization. Affected is an unknown function. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2024-8509. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in SPIP up to 4.1.18/4.2.15/4.3.1. It has been rated as very critical. This issue affects some unknown processing of the component Multipart File Upload Handler. The manipulation leads to reliance on file name or extension of externally-supplied file. The identification of this vulnerability is CVE-2024-8517. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in hapifhir HL7 FHIR Core Artifacts up to 6.3.22. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to xml external entity reference. This vulnerability was named CVE-2024-45294. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

中科院研究员使用从嫦娥五号带回的月壤样本中找到的 3 颗火山玻璃珠证明，月球上的岩浆活动可以追溯到 1.2 亿年前。这一研究结果再次刷新了人们对月球岩浆活动的认知。岩浆活动是了解月球热演化的重要依据，岩浆活动停止表明月球失去了内动力，也即地质意义上的“死亡”。科学家根据美国“阿波罗”号和前苏联“月球”号月球探测任务返回的 9 次月球样品，以及从地球上收集到的月球陨石样品曾认为，月球最晚的火山活动发生在 30 亿年前。2021 年我国科学家利用嫦娥五号探测器带回的月壤中挑选出的玄武岩颗粒样品，证明了 20 亿年前月球上仍然存在着较大规模的岩浆活动，将此前认为的月球“寿命”延长了约 10 亿年。科学家通过遥感技术对月球地貌进行观察并通过撞击坑统计定年的数据猜测，月球大在约近 1 亿年可能仍存在火山活动，但却一直没有返回样品的数据支撑。新研究为此提供了证据。

A vulnerability classified as critical was found in Apple macOS up to 10.13.1. This vulnerability affects unknown code of the component tcpdump. The manipulation leads to improper resource management. This vulnerability was named CVE-2017-12989. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

今日暂未更新资讯~
更多最新文章，请访问SecWiki

SonicWall has revealed that a recently patched critical security flaw impacting SonicOS may have come under active exploitation, making it essential that users apply the patches as soon as possible. The vulnerability, tracked as CVE-2024-40766, carries a CVSS score of 9.3 out of a maximum of 10. "An improper access control vulnerability has been identified in the SonicWall SonicOS management

A vulnerability was found in h2oai H2O up to 3.46.0.4. It has been classified as problematic. This affects an unknown part of the component JDBC Connection Handler. The manipulation of the argument connection_url leads to deserialization. This vulnerability is uniquely identified as CVE-2024-45758. Access to the local network is required for this attack. Furthermore, there is an exploit available.