Aggregator

Developers Listed as Public Contact Points Targeted in Phishing Campaign
A supply chain attack that subverted legitimate Google Chrome browser extensions to inject data-stealing malware is more widespread than security researchers first suspected. So far researchers have identified 36 subverted extensions collectively used by 2.6 million people.

Integrity Technology Group Built Botnet for Chinese Hackers, US Treasury Says
The Department of Treasury blacklisted Integrity Technology Group, declaring transactions with the company to be off-limits for U.S. financial institutions and persons. The effect will likely have more symbolic than actual disruptive effect.

iPhone Maker Introduced Feature Without Explicit Consent
Apple's artificial intelligence-led photo analyzer is raising privacy concerns months after the company appears to have enabled the feature by default. It uses a combination of on-device machine learning and encrypted cloud-based processing.

Indiana Attorney General Fines Westend Dental $350K in 2020 Ransomware Hack
An Indiana dental practice agreed to pay the state $350,000 and implement a long list of data security improvements following an alleged 2020 ransomware breach "cover up" that came to light when state regulators investigated a patient complaint about unfulfilled requests for dental X-rays.

Could Advanced Secrets Management be Your Way to Feeling Relieved? Think about it. If you could significantly decrease the likelihood of security breaches and data leaks in your organization, wouldn’t that be a massive weight lifted off your shoulders? But how to systematically fortify your cybersecurity? The answer lies in Non-Human Identities (NHIs) and Secrets […]

The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Entro.

The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Security Boulevard.

Where Does Your Cloud Security Stand? Does your organization’s data management strategy consider non-human identities (NHIs) and secret security management? In the intricate dance of safeguarding data, ensuring the security of machine identities, or NHIs, and their corresponding secrets is pivotal. This practice remains an essential element of best cloud security practices and an effective […]

The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Entro.

The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Security Boulevard.

Humans are spectacularly bad at predicting the future. Which is why, when someone appears to be able to do it on a regular basis, they are hailed as visionaries, luminaries and celebrated with cool names like Nostradamus and The Amazing Kreskin. Nostradamus made his fame on predictions about the distant future, but that technique has […]

The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Blog.

The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Security Boulevard.

A vulnerability was found in zenml-io ZenML up to 0.56.1 and classified as problematic. This issue affects some unknown processing. The manipulation of the argument logo_url leads to cross site scripting. The identification of this vulnerability is CVE-2024-2171. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in ZenML up to 0.56.1. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to insufficient granularity of access control. The identification of this vulnerability is CVE-2024-2035. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in zenml-io ZenML up to 0.55.4. Affected is an unknown function of the file /api/v1/users/test_race. The manipulation leads to race condition within a thread. This vulnerability is traded as CVE-2024-2032. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in ZenML up to 0.56.2. This vulnerability affects unknown code of the component Password Change Handler. The manipulation leads to improper authentication. This vulnerability was named CVE-2024-2213. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in ZenML up to 0.56.2. It has been declared as problematic. This vulnerability affects unknown code of the component Content-Security-Policy. The manipulation leads to improper restriction of rendered ui layers. This vulnerability was named CVE-2024-2383. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in ZenML up to 0.56.3. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. This vulnerability is handled as CVE-2024-4680. The attack may be launched remotely. There is no exploit available.

A vulnerability was suspected in ZenML up to 0.57.0. This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all.

Healthcare organizations of all shapes and sizes will be held to a stricter standard of cybersecurity starting in 2025 with new proposed rules, but not all have the budget for it.

A vulnerability classified as critical has been found in Inaba Denki Sangyo AC-PD-WAPU, AC-PD-WAPUM, AC-PD-WAPU-P, AC-PD-WAPUM-P, AC-WAPU-300, AC-WAPUM-300, AC-WAPU-300-P and AC-WAPUM-300-P. Affected is an unknown function. The manipulation leads to os command injection. This vulnerability is traded as CVE-2023-31198. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Inaba Denki Sangyo AC-PD-WAPUM, AC-PD-WAPU-P, AC-PD-WAPUM-P, AC-WAPU-300, AC-WAPUM-300, AC-WAPU-300-P and AC-WAPUM-300-P. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2023-31196. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply the suggested workaround.

A vulnerability, which was classified as critical, has been found in Kingsoft WPS Office 10.8.0.6186. This issue affects some unknown processing. The manipulation leads to os command injection. The identification of this vulnerability is CVE-2023-32548. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Chatwork Desktop Application up to 2.6.43 on macOS. Affected is an unknown function. The manipulation leads to code injection. This vulnerability is traded as CVE-2023-32546. The attack needs to be approached locally. There is no exploit available.