Aggregator

South Korea's National Cyber Security Center (NCSC) warns that state-backed DPRK hackers hijacked flaws in a VPN's software update to deploy malware and breach networks. [...]

Ученые пересматривают основы квантовой теории.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Exam Numbers’ appeared first on Security Boulevard.

A vulnerability was found in Traffic Manager Plugin up to 1.4.5 on WordPress. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2024-7485. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Blox Page Builder Plugin up to 1.0.65 on WordPress. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to unrestricted upload. This vulnerability was named CVE-2024-6315. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in CRM Perks Forms Plugin up to 1.1.3 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2024-7484. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Horizontal Scrolling Announcements Plugin up to 2.4 on WordPress and classified as critical. Affected by this issue is some unknown functionality of the component Shortcode Handler. The manipulation leads to sql injection. This vulnerability is handled as CVE-2023-5000. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Pantera CMS 401.152/402.072 and classified as critical. Affected by this vulnerability is an unknown functionality of the component User Profile Management. The manipulation leads to Privilege Escalation. This vulnerability is known as CVE-2024-40531. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in AMD 3rd Gen EPYC Processors, 4th Gen EPYC Processors, EPYC Embedded 7003 and EPYC Embedded 9003. Affected is an unknown function of the component SEV-SNP. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2024-21978. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Pantera CRM 401.152/402.072. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to permission issues. The identification of this vulnerability is CVE-2024-40530. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic was found in AMD 3rd Gen EPYC Processors, 4th Gen EPYC Processors, EPYC Embedded 7003 and EPYC Embedded 9003. This vulnerability affects unknown code of the component SNP Firmware. The manipulation leads to memory corruption. This vulnerability was named CVE-2023-31355. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in AMD 3rd Gen EPYC Processors, 4th Gen EPYC Processors, EPYC Embedded 7003 and EPYC Embedded 9003. This affects an unknown part of the component SNP Firmware. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2024-21980. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

Electronic manufacturing services provider Keytronic has revealed that it suffered losses of over $17 million due to a May ransomware attack. [...]

Researchers urge organizations using Apache OFBiz to address a critical bug, following reports of active exploitation of another flaw. Experts urge organizations to address a new critical vulnerability, tracked as CVE-2024-38856, in Apache OFBiz. The vulnerability is an incorrect authorization issue in Apache OFBiz that impacts versions through 18.12.14, version 18.12.15 addressed the flaw. “Unauthenticated […]

New report warns of escalating hardware supply chain attacks, with 19% of organizations impacted and nearly all IT leaders expecting nation-state involvement

Как фишинговые письма на иврите маскируются под известные СМИ.

For You Plague: U.S. Justice Dept. and Federal Trade Commission file lawsuit, alleging TikTok broke the COPPA law, plus a previous injunction.

The post TikTok Abuses Kids, say DoJ and FTC appeared first on Security Boulevard.