Aggregator

Providers of digital products and services to the EU are being impacted by a suite of new cybersecurity regulations coming into force. Among them is the Digital Operations Resilience Act (DORA), and we've developed a checklist to help you manage key components on your journey to compliance.

The post Sonatype can help you navigate DORA compliance appeared first on Security Boulevard.

A vulnerability was found in Traefik. It has been rated as critical. Affected by this issue is some unknown functionality of the component HTTP Header Handler. The manipulation of the argument X-Forwarded leads to use of less trusted source. This vulnerability is handled as CVE-2024-45410. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in JetBrains YouTrack. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to incorrect authorization. This vulnerability is known as CVE-2024-47160. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in FreeImage up to 3.18.0. It has been classified as critical. Affected is an unknown function of the file PluginXPM.cpp of the component libfreeimage. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2024-31570. Access to the local network is required for this attack. There is no exploit available.

A vulnerability was found in Couchbase up to 7.2.5/7.6.1 and classified as problematic. This issue affects some unknown processing of the component HTTP Header Handler. The manipulation of the argument Host leads to injection. The identification of this vulnerability is CVE-2024-25673. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in NetCat CMS up to 6.4.0.24126.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-8652. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in JetBrains YouTrack. This affects an unknown part of the component Imports Page. The manipulation leads to insufficiently protected credentials. This vulnerability is uniquely identified as CVE-2024-47162. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in JetBrains YouTrack. Affected by this issue is some unknown functionality of the component Workflow Handler. The manipulation leads to incorrect authorization. This vulnerability is handled as CVE-2024-47159. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Ivanti CSA up to 4.6 Patch 518. Affected by this vulnerability is an unknown functionality. The manipulation leads to path traversal. This vulnerability is known as CVE-2024-8963. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in NetCat CMS up to 6.4.0.24126.2/6.4.0.24247. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-8653. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Microsoft Office. It has been rated as critical. This issue affects some unknown processing of the component Visio. The manipulation leads to improper access controls. The identification of this vulnerability is CVE-2024-38016. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in NetCat CMS up to 6.4.0.24126.2. It has been declared as problematic. This vulnerability affects unknown code of the component HTTP Request Handler. The manipulation leads to observable response discrepancy. This vulnerability was named CVE-2024-8651. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

As threat actors continue to evolve their attacks to circumvent security measures, cyber insurers are raising the bar for prospective healthcare security clients. Underwriters are increasing their scrutiny and adding new coverage requirements, said Chris Henderson of cybersecurity company Huntress.

Essen Health Care's Hiren Dave Makes the Case for Integration of CIO-CISO Roles
As cloud computing, DevOps and automation continue to evolve, the lines between IT functions are fading, making security integral to these processes. Hiren Dave, CIO and CISO at Essen Health Care, shares how combining the roles of CIO and CISO improves risk management and communication.

EVP Johan Gerber on How Threat Intelligence Can Prevent Fraud, Protect Payments
Mastercard's proposed purchase of Recorded Future for $2.65 billion will bring advanced threat intelligence into its payment systems. EVP Johan Gerber explains how this move improves fraud detection and prevention and strengthens Mastercard's cybersecurity in an evolving digital payments landscape.

Also: US SEC Settles With Prager Metis, Rari Capital
This week, Delta Prime and Ethena were hacked, Lazarus' funds were frozen, the SEC settled with Prager Metis and Rari Capital, Sam Bankman-Fried sought a new trial, the SEC accused NanoBit and CoinW6 of scams, the CTFC sought to fight pig butchering, and Wormhole integrated World ID and Solana.

New Report Accuses 9 Platforms of Surveillance of Users, Points to Privacy Concerns
The U.S. Federal Trade Commission on Thursday published a report detailing how the largest social media and streaming services surveil both users and nonusers across the web while collecting vast troves of data, pointing to significant privacy concerns for children and teens.

Authors/Presenters:Wenxin Li, Xin He, Yuan Liu, Keqiu Li, Kai Chen, Zhao Ge and Zewei Guan, Heng Qi, Song Zhang, Guyue Liu

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Flow Scheduling With Imprecise Knowledge appeared first on Security Boulevard.

Today, Ivanti warned that threat actors are exploiting another Cloud Services Appliance (CSA) security flaw in attacks targeting a limited number of customers. [...]