Aggregator

A vulnerability was found in themesebrand Chatvia 5.3.2. It has been declared as critical. This vulnerability affects unknown code. The manipulation of the argument User profile name leads to permission issues. This vulnerability was named CVE-2024-40514. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Opexus Foiaxpress Public Access Link 11.1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to improper authentication. This vulnerability was named CVE-2024-53553. The attack can be initiated remotely. Furthermore, there is an exploit available.

ESET detailed a flaw that could allow a bypass of the Secure Boot in UEFI systems

Researchers detailed a now-patched vulnerability that could allow a bypass of the Secure Boot mechanism in UEFI systems. ESET disclosed details of a now-patched vulnerability, tracked as CVE-2024-7344 (CVSS score: 6.7), that could allow a bypass of the Secure Boot mechanism in UEFI systems. The Unified Extensible Firmware Interface (UEFI) is a specification that defines a software interface […]

In recent cybersecurity news, Infoblox Threat Intel discovered a botnet compromising 13,000 Mik

A vulnerability classified as problematic has been found in Django up to 4.2.17/5.0.10/5.1.4. This affects an unknown part of the component IPv6 Validation. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2024-56374. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Машины выходят вперёд, оставляя ручное программирование далеко позади.

Rockstar2FA is a PaaS kit that mimics the legitimate credential-request behavior of cloud/SaaS platforms. Phishing campaigns are delivered via Telegram and use unique URLs to route users to credential-capturing counterfeit login pages.  These pages masquerade as popular services and steal login credentials along with multifactor authentication tokens via HTTP POST requests to adversary-controlled backend servers.  […]

The post FlowerStorm PaaS Platform Attacking Microsoft Users With Fake Login Pages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

In an exciting development for organizations struggling with data security, 1touch.io has announced its Sensitive Data Intelligence platform as a Software-as-a-Service (SaaS) solution. This release extends 1touch.io’s powerful Contextual AI-driven data discovery and classification capabilities to a wider range of organizations, allowing businesses of all sizes to eliminate security gaps, reduce risks, and unlock the full potential of their data. The SaaS deployment enhances 1touch.io’s existing deployment options—air-gapped, on-premises, virtual private cloud (VPC), and hybrid—providing … More →

The post 1touch.io’s SaaS offering delivers enterprise-grade security appeared first on Help Net Security.

关键词网络攻击据The Hacker News消息，惠普沃尔夫安全公司发现有网络攻击者在图片中隐藏恶意代码，以传播 VIP Keylogger 和 0bj3ctivity Stealer 等恶意软件。

关键词安全漏洞新发现的漏洞 CVE-2024-7344 被认定为UEFI 安全启动机制中的一个严重缺陷，可能会影响大多数基于 UEFI 的系统。ESET 的研究人员发现了这一漏洞，它允许攻击者绕过安全

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

环境异常 当前环境异常，完成验证后即可继续访问。 去验证