Xuan Son NGUYEN

Important 𝐂𝐕𝐄 𝐀𝐥𝐞𝐫𝐭: CVE-2023-7028 This critical CVE (Common Vulnerability and Exposure) from 2023 affects GitLab and could allow attackers to take control of administrator accounts. What is CVE-2023-7028? This vulnerability exists in GitLab's password reset functionality. An attacker could potentially exploit it to gain access to an administrator account by providing two email addresses during the reset process. What can you do? If you're a GitLab administrator, prioritize patching your instance to the latest version immediately. GitLab recommends enabling two-factor authentication (2FA) for all users as an additional security measure, as it would prevent unauthorized access even if the password is compromised through this vulnerability. visit our website: www.hyper-ict.com Here's a helpful resource for more information: https://lnkd.in/d2MXaTMS #GitLab #CVE #VulnerabilityManagement #Cybersecurity #hyperict

1

⛔ GOOGLE CHROME BROWSER ⛔ Urgent Security update required ! Google on Thursday rolled out fixes to address a high-severity security flaw in its Chrome browser that it said has been exploited in the wild. Assigned the CVE identifier CVE-2024-5274, the vulnerability relates to a type confusion bug in the V8 JavaScript and WebAssembly engine. It was reported by Clément Lecigne of Google's Threat Analysis Group and Brendon Tiszka of Chrome Security on May 20, 2024. Type confusion vulnerabilities occur when a program attempts to access a resource with an incompatible type. It can have serious consequences as it allows threat actors to perform out-of-bounds memory access, cause a crash, and execute arbitrary code. The development marks the fourth zero-day that Google has patched since the start of the month after CVE-2024-4671, CVE-2024-4761, and CVE-2024-4947. #Google #Chrome #GoogleChrome #WeAreLoughTec #CyberSecurity Link to Article below ⬇ https://lnkd.in/gGbRxwWG

4

🚨Here is a great discovery of a very interesting repository around a SOC based on 4 Open Source tools: 👉Wazuh: Real-time monitoring and alerting for security events. 👉DFIR-IRIS: Streamlined incident response and forensics capabilities. 👉Shuffle: Automated workflow management to streamline security processes. 👉MISP: Open source threat intelligence platform. ✅T-Guard - Nusantara ✔Verified link to the official repository 🔗https://lnkd.in/eRw6y3Ts ⚙As a reminder, T-Guard is a solution around a SOC that leverages the strength of leading open-source tools to provide solid protection for your digital assets. 🤝The integrated approach ensures comprehensive defense against a wide range of cyber threats, making your systems and data safer and more secure. ✅Complete documentation (installation, configuration) ✔Verified link to the official page 🔗https://lnkd.in/eSwQwYAc 🖼Image Source: https://lnkd.in/emmNMJcg 👨 💻Set up your Labs and have fun!! #soc #opensource #security #cybersecurity #blueteam

5

🚨High Risk Vulnerability Alert! 🚨: CVE-2024-3435 A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities. CVSSv3.1 Base Score: 8.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #lollms #parisneo #apisecurity #owasp https://lnkd.in/drxXWheK

7

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-34701 CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there. Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings. As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm. CVSSv3.1 Base Score: 5.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #CreateWiki #MediaWiki #apisecurity #owasp https://lnkd.in/dwCZs8Pd

5

Is your web app using Telnet or FTP? It's time for an update... 😉 Secure protocols in web applications go a long way in preventing session hijacking at the networking level. In this article, we have packed the best practices for implementing TLS and secure protocols in your application to make them safer. #sessionHijacking #appDesign #applicationSecurity #securingWebApps #negativePID https://lnkd.in/eM-cWtWt

1

Attention #mautic Users: Urgent News Alert! CVE-2024-2731 Detected – Protect Your Data Now! 🚨 A medium-severity vulnerability has been found in Mautic, potentially granting unauthorized access to sensitive information. Learn more and take action to safeguard your data: https://lnkd.in/dgnFyY2P #Mautic #SecurityVulnerability #CVE20242731 #DataPrivacy #SensitiveInformation #UserPermissions #DataProtection #Cybersecurity #PatchUpdate

1

⚡Vulnerability Analysis⚡CVE-2024-3400 : Exploiting Palo Alto Networks PAN-OS It’s an arbitrary file creation vulnerability in the GlobalProtect portals of Palo Alto Networks PAN-OS software that will allow unauthenticated threat actors to execute arbitrary code and deploy malware to the targets’ devices with root privilege. We prepare a comprehensive Mitigation and Response Advisory. Read more 👉 https://lnkd.in/gM_7xPCw

12

🚨High Risk Vulnerability Alert! 🚨: CVE-2022-32510 An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. CVSSv3.1 Base Score: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #nuki #apisecurity #owasp https://lnkd.in/dFDPgyfp

3

[CIP Anonymous IPs of Week 4, April] Check the analysis results of detected anonymous IPs using #VPN #Proxy #Tor #Scanner #C2 IP. https://lnkd.in/gyVfTtPD #credentialstuffing #bruteforcing #DDoS #scanning #hacking #malware

2

🚀 Last but not least, in my KubeCon Highlights Part 2 video, I talked to Anaïs Urlichs about her work at Aqua Security in the open source team on #Trivy, a comprehensive cloud-native security scanner. 💡Trivy features a Kubernetes operator for integrating security scans within a cluster, allowing engineers and SREs to manage and visualize security scans through familiar observability tools easily. Trivy also can scan for vulnerabilities, configurations, exposed secrets, license issues, and RBAC configurations, emphasizing its open source nature and availability for use through GitHub, local CLI, CI/CD pipelines, and within Kubernetes clusters. ➡️ Learn more about Trivy in the full interview on YouTube: https://lnkd.in/gWFR6eNx #opensource #cloudnativesecurity #cncf #kubecon #kubernetessecurity

6

Cyber Threat Intelligence ®: Vulnerability in Apache Project Lets Hackers Launch Supply Chain Attacks Researchers discovered a vulnerability in an archived Apache project, highlighting the risk of using outdated third-party dependencies, where attackers can exploit the way package managers prioritize public repositories to install a malicious package with the same name as a legitimate private dependency. https://lnkd.in/gscFyYQq

63

1 commentaire

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-0972 The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.5 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content. CVSSv3.1 Base Score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #wordpressplugin #apisecurity #owasp https://lnkd.in/dsrTU2ak

2

Designing access tokens properly is essential to a system’s security. But how should you design and serve your tokens - JWTs, phantom or split? Find the answer: https://bit.ly/3Je6dVd

4

⚠️Low Risk Vulnerability Alert⚠️: CVE-2024-2032 A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications. CVSSv3.1 Base Score: 3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #zenml #apisecurity #owasp https://lnkd.in/d8iP-YRU

1