Aggregator

Threat hunters are warning about an updated version of the Python-based NodeStealer that's now equipped to extract more information from victims' Facebook Ads Manager accounts and harvest credit card data stored in web browsers. "They collect budget details of Facebook Ads Manager accounts of their victims, which might be a gateway for Facebook malvertisement," Netskope Threat Labs researcher

A vulnerability was found in Okta Privileged Access Server Agent up to 1.84.0 and classified as critical. Affected by this issue is some unknown functionality of the component SFTD. The manipulation leads to improper input validation. This vulnerability is handled as CVE-2024-9875. Attacking locally is a requirement. There is no exploit available.

A vulnerability has been found in Querydsl 5.1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component JPAQuery. The manipulation of the argument orderBy leads to sql injection. This vulnerability is known as CVE-2024-49203. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Brocade SANnav up to 2.2.1. Affected is an unknown function of the component Switch Password Handler. The manipulation leads to sensitive information in log files. This vulnerability is traded as CVE-2022-43936. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Piwigo 14.5.0. This issue affects some unknown processing of the component Configuration Page. The manipulation of the argument Page banner leads to cross site scripting. The identification of this vulnerability is CVE-2024-52701. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as critical was found in eSoft Planner 3.24.08271-USA. This vulnerability affects unknown code of the component Web Request Handler. The manipulation leads to improper access controls. This vulnerability was named CVE-2024-48536. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability was found in eSoft Planner 3.24.08271-USA. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Appointment Availability Module. The manipulation leads to denial of service. This vulnerability is handled as CVE-2024-48530. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability classified as problematic has been found in eSoft Planner 3.24.08271-USA. This affects an unknown part. The manipulation of the argument Name leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-48535. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in eSoft Planner 3.24.08271-USA. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Camp Details Module. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-48534. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in eSoft Planner 3.24.08271-USA. It has been classified as problematic. Affected is an unknown function of the component Rental Availability Module. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-48531. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in D-Link DI-8200 16.07.26A1 and classified as critical. This issue affects the function msp_info_htm. The manipulation of the argument flag/cmd leads to Privilege Escalation. The identification of this vulnerability is CVE-2024-51151. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in D-Link DI-8003 16.07.26A1 and classified as critical. This vulnerability affects the function ipsec_road_asp. The manipulation of the argument host_ip leads to buffer overflow. This vulnerability was named CVE-2024-52755. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in D-Link DI-8003 16.07.16A1. This affects the function arp_sys_asp. The manipulation of the argument notify leads to buffer overflow. This vulnerability is uniquely identified as CVE-2024-52757. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in D-Link DI-8003 16.07.16A1. Affected by this issue is the function tgfile_htm. The manipulation of the argument fn leads to buffer overflow. This vulnerability is handled as CVE-2024-52754. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in Zimbra Collaboration Suite up to 10.0. Affected by this vulnerability is an unknown functionality of the component Webmail. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-45510. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in CM Table of Contents Plugin up to 1.2.3 on WordPress. Affected is an unknown function of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-5029. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

If you’re familiar with platforms like Drata, you may appreciate their streamlined compliance processes and integrations. But if you’re ready for something beyond automation and integration (think powerful AI-driven risk management,  live visual dashboards, and extensive framework mappings), Centraleyes delivers in ways Drata just can’t match! Let’s take a closer look at both platforms and […]

The post 10 Best Drata Alternatives to Consider for Compliance Management in 2024 appeared first on Centraleyes.

The post 10 Best Drata Alternatives to Consider for Compliance Management in 2024 appeared first on Security Boulevard.

A vulnerability was found in Alphabetical List Plugin up to 1.0.3 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The identification of this vulnerability is CVE-2024-8157. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Media File Rename, Find Unused File, Add Alt Text, Caption, Desc for Image SEO Plugin up to 1.4.x on WordPress. It has been declared as problematic. This vulnerability affects unknown code of the component SVG Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-10482. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Brocade Fabric OS up to 9.2.0b/9.2.1a. It has been classified as critical. This affects an unknown part of the component portcfg Command Handler. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2024-7517. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.