All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

**Exploitability Metrics**

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.

**Vulnerable System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

**Subsequent System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

GHSA-62cx-5xj4-wfm4: ggit is vulnerable to Command Injection via the fetchTags(branch) API

The vast majority of organizations in the region saw more attacks in the past year, but most don't feel prepared for future incidents.

Source: Viacheslav Lopatin via Shutterstock

Organizations in Saudi Arabia, the United Arab Emirates, and Turkey suffered more than 10 attacks in the past year on average — and the vast majority of business and IT professionals expect the coming year to be worse — driving efforts by cybersecurity experts in those countries to simplify and modernize their cyber defenses and IT infrastructure.

Overall, less than half of organizations (46%) feel well-prepared to defend against future cyberattacks, according to a survey of nearly 1,000 security professionals in those three regions published by Internet-services provider Cloudflare. With geopolitical conflict on the rise and cybercriminals increasingly focused on the Middle East region and Turkey, Bashar Bashaireh, regional vice president at Cloudflare, said in a statement.

"Organizations across the Middle East and Türkiye are managing an increasingly complex cybersecurity landscape," he said. "With incidents on the rise in both volume and frequency, this balancing act becomes even more challenging, leaving leaders with a sense of diminishing control over their organizations’ technological and security frameworks."

Cyberattacks have become commonplace in the region, but each nation's threat profile is slightly different. While the vast majority of companies in the UAE, for example, have suffered cyberattacks in the past two years, approximately a quarter of those incidents were caused by insiders. Both Saudi Arabia and the UAE have seen an increase in attacks over the past year, with DDoS attacks alone leveled by hacktivists jumping 70%. And in another wrinkle, a group of cybercriminals recently targeted Turkish users with Android malware aimed at stealing accounts.

The three countries have all embarked on major investments in modernization, pursuing major initiatives such as Abu Dhabi's Economic Vision 2030 and Saudi Arabia's Vision 2030, but the countries also need to strengthen their cybersecurity efforts to protect their investments, Chris Murphy, managing director at FTI Consulting, said in a November 2023 analysis of Middle East firms' cyber-readiness.

"Threat actors will not pause their activities while these strategic plans unfold, and without the necessary security and preparedness measures in place, cyber risks will threaten the vitality of key sectors and the overall economic growth of the region," he said.

**Simplifying & Modernizing Cyber Defense**

The majority of organizations in the Middle East and Turkey plan to increase cybersecurity's share of their IT budgets. The top priority for businesses across the region is to consolidate and simplify their cybersecurity infrastructure, with half of all organizations ranking the effort as a Top 3 initiative, followed by almost half (47%) prioritizing the modernization of their applications, according to Cloudflare's report.

"Despite their plans, many feel they are still not ready for what lies ahead, and there is a 'confidence gap' in key areas for a large number of respondents," Cloudflare stated.

Those include the security of applications and data in the public cloud, a lack of oversight into their supply chain, and a lack of visibility and control over the devices that access their networks, Cloudflare stated in its report.

The good news is that some nations have made strong progress in securing their systems, to the point that the Kingdom of Saudi Arabia is ranked second, after the United States, in the International Telecommunication Union's Global Cybersecurity Index.

**Most Pessimistic Industries: Media, Telecom & Gaming**

According to Cloudflare, cyberattackers in the past year targeted financial services, IT firms, and companies providing business and professional services most often, and were more likely to target larger organizations. Yet, the sectors most worried about future cyberattacks are the media and telecom sector, and the gaming sector, with 97% and 92% of respondents, respectively, predicting a cybersecurity incident in the next 12 months.

Perhaps unsurprisingly, the telecom and media sectors are among the least staffed as well, with 39% of information-security roles remaining unfilled, according to a recent report by cybersecurity firm Kaspersky.

"The growth rate of the domestic IT market in some developing regions is changing so rapidly, the labor market cannot manage to educate and train the appropriate specialists with the necessary skills and expertise in such tight deadlines," Vladimir Dashchenko, a security evangelist with Kaspersky's ICS CERT, said in a statement.

Companies in each region have struggled to meet government-backed cybersecurity frameworks, with 62% of companies in Turkey meeting the requirements of the EU cybersecurity framework, 69% of Saudi firms meeting the Saudi Arabian Monetary Authority (SAMA) framework, and many UAE organizations falling short in complying with the National Electronic Security Authority (NESA) framework.

Yet, despite that, executives' commitment to cybersecurity remains lukewarm, Cloudflare stated in the report

"Interestingly, despite the increasing volume of attacks, many cite a lack of buy-in from leadership as a key challenge," the firm stated. "Perhaps this is a case of cybersecurity fatigue, but whatever the cause, senior leaders cannot afford to ignore the challenges facing their organizations."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Mideast, Turkey Cyber Threats Spike, Prompting Defense Changes

Ukraine has claimed responsibility for a cyber attack that targeted Russia state media company VGTRK and disrupted its operations, according to reports from Bloomberg and Reuters.
The incident took place on the night of October 7, VGTRK confirmed, describing it as an "unprecedented hacker attack." However, it said "no significant damage" was caused and that everything was working normally

Ukraine has claimed responsibility for a cyber attack that targeted Russia state media company VGTRK and disrupted its operations, according to reports from Bloomberg and Reuters.

The incident took place on the night of October 7, VGTRK confirmed, describing it as an "unprecedented hacker attack." However, it said "no significant damage" was caused and that everything was working normally despite attempts to interrupt radio and TV broadcasts.

That said, Russian media outlet Gazeta.ru reported that the hackers wiped "everything" from the company's servers, including backups, citing an anonymous source.

A source told Reuters that "Ukrainian hackers 'congratulated' Putin on his birthday by carrying out a large-scale attack on the all-Russian state television and radio broadcasting company."

The attack is believed to be the work of a pro-Ukrainian hacker group called Sudo rm-RF. The Russian government has since said an investigation into the attack is ongoing and that it "aligns with the anti-Russian agenda of the West."

The development comes amid continued cyber attacks targeting both Russia and Ukraine against the backdrop of the Russo-Ukrainian war that commenced in February 2022.

Ukraine's State Service of Special Communications and Information Protection (SSSCIP), in a report published late last month, said it has observed an increase in the number of cyber attacks targeting security, defense, and energy sectors, with 1,739 incidents registered in the first half of 2024 reaching, up 19% from 1,463 in the previous half.

Forty-eight of those attacks have been deemed either critical or high in severity level. Over 1,600 incidents have been classified as medium and 21 have been tagged as low in severity. The number of critical severity incidents witnessed a drop from 31 in H2 2023 to 3 in H1 2024.

Over the past two years, adversaries have pivoted from staging destructive attacks to securing covert footholds to extract sensitive information, the agency said.

"In 2024, we observe a pivot in their focus towards anything directly connected to the theater of war and attacks on service provider — aimed at maintaining a low profile, sustaining a presence in systems related to war and politics," Yevheniya Nakonechna, head of State Cyber Protection Centre of the SSSCIP, said.

"Hackers are no longer just exploiting vulnerabilities wherever they can but are now targeting areas critical to the success and support of their military operations."

The attacks have been primarily attributed to eight different activity clusters, one of which includes a China-linked cyber espionage actor tracked as UAC-0027 that was observed deploying a malware strain called DirtyMoe to conduct cryptojacking and DDoS attacks.

SSSCIP has also highlighted intrusion campaigns staged by a Russian state-sponsored hacking group dubbed UAC-0184, pointing out its track record of initiating communications with prospective targets using messaging apps like Signal with the goal of distributing malware.

Another threat actor that has remained laser-focused on Ukraine is Gamaredon, a Russian hacking crew that's also known as Aqua Blizzard (previously Actinium), Armageddon, Hive0051, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, UAC-0010, UNC530, and Winterflounder.

"The intensity of the physical conflict has noticeably increased since 2022, but it's worth noting that the level of activity from Gamaredon has remained consistent – the group has been methodically deploying its malicious tools against its targets since well before the invasion began," Slovak cybersecurity firm ESET said in an analysis.

Notable among the malware families is an information stealer called PteroBleed, which also relies on an arsenal of downloaders, droppers, weaponizers, backdoors, and other ad hoc programs to facilitate payload delivery, data exfiltration, remote access, and propagation via connected USB drives.

"Gamaredon has also demonstrated resourcefulness by employing various techniques to evade network-based detections, leveraging third-party services such as Telegram, Cloudflare, and ngrok," security researcher Zoltán Rusnák said. "Despite the relative simplicity of its tools, Gamaredon's aggressive approach and persistence make it a significant threat."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Pro-Ukrainian Hackers Strike Russian State TV on Putin's Birthday

Qualcomm has rolled out security updates to address nearly two dozen flaws spanning proprietary and open-source components, including one that has come under active exploitation in the wild.
The high-severity vulnerability, tracked as CVE-2024-43047 (CVSS score: 7.8), has been described as a user-after-free bug in the Digital Signal Processor (DSP) Service that could lead to "memory corruption

Mobile Security / Privacy

Qualcomm has rolled out security updates to address nearly two dozen flaws spanning proprietary and open-source components, including one that has come under active exploitation in the wild.

The high-severity vulnerability, tracked as CVE-2024-43047 (CVSS score: 7.8), has been described as a user-after-free bug in the Digital Signal Processor (DSP) Service that could lead to "memory corruption while maintaining memory maps of HLOS memory."

Qualcomm credited Google Project Zero researcher Seth Jenkins-Google Project Zero and Conghui Wang for reporting the flaw, and Amnesty International Security Lab for confirming in-the-wild activity.

"There are indications from Google Threat Analysis Group that CVE-2024-43047 may be under limited, targeted exploitation," the chipmaker said in an advisory.

"Patches for the issue affecting FASTRPC driver have been made available to OEMs together with a strong recommendation to deploy the update on affected devices as soon as possible."

The full scope of the attacks and their impact is presently unknown, although it's possible that it may have been weaponized as part of spyware attacks targeting civil society members.

October's patch also addresses a critical flaw in the WLAN Resource Manager (CVE-2024-33066, CVSS score: 9.8) that's caused by an improper input validation and could result in memory corruption.

The development comes as Google released its own monthly Android security bulletin with fixes for 28 vulnerabilities, which also comprise issues identified in components from Imagination Technologies, MediaTek, and Qualcomm.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Qualcomm Urges OEMs to Patch Critical DSP and WLAN Flaws Amid Active Exploits

The BMS/BAS controller suffers from an arbitrary file deletion vulnerability. Input passed to the 'file' parameter in calendarFileDelete.php is not properly sanitised before being used to delete calendar files. This can be exploited by an unauthenticated attacker to delete files with the permissions of the web server using directory traversal sequences passed within the affected POST parameter.

ABB Cylon Aspect 3.08.01 (calendarFileDelete.php) Arbitrary File Deletion

Okta fixed a vulnerability in its Classic product that allowed attackers to bypass sign-on policies. Exploitation required valid…

Okta fixed a vulnerability in its Classic product that allowed attackers to bypass sign-on policies. Exploitation required valid credentials and the use of an “unknown” device. Affected users should review system logs.

Okta, a leading identity and access management provider, recently announced patching a critical security vulnerability affecting its Classic product. The flaw, which could allow attackers to bypass application-specific sign-on policies, originated in a July 17, 2024 update and remained exploitable until the issue was patched on October 4, 2024.

The vulnerability, now addressed in Okta’s production environment, could have allowed unauthorized access to applications by bypassing key security controls, including device-type restrictions, network zones, and certain authentication requirements.

However, **Okta** confirmed that the vulnerability only affected organizations using Okta Classic, and exploitation was contingent on a combination of factors, limiting the scope of the vulnerable systems.

****What Happened?****

Okta identified the vulnerability on September 27, 2024, and after an internal investigation, determined that it had originated from a software update rolled out on July 17, 2024. The issue was specific to Okta Classic and impacted organizations that had configured application-specific sign-on policies, especially those that relied on device-type restrictions or additional conditions outside the platform’s Global Session Policy.

According to Okta’s security advisory, an attacker would need to meet several conditions to carry out a successful attack. First, the attacker needed access to valid credentials—either through phishing, credential stuffing, or brute-force attacks. Second, the organization had to be using application-specific sign-on policies.

Lastly, the attacker had to be using a device or script that Okta evaluated as an “unknown” user-agent type, which might evade detection by standard device-type restrictions. Once these conditions were met, the attacker might have bypassed sign-on policies that typically require additional layers of authentication or device verification.

Okta has provided specific search recommendations that administrators can use to identify potential exploit attempts in their logs. This includes looking for unexpected successful authentication events where the device type was flagged as “unknown.” Okta also advised customers to search for unsuccessful authentication attempts, which could indicate credential-based attacks preceding a successful login.

Additionally, organizations were encouraged to monitor for deviations in user behaviour, such as unfamiliar IP addresses, geolocations, or access times that could signal unauthorized activity.

**Piyush Pandey**, CEO of identity and access security provider Pathlock, provided insight into the broader implications of such vulnerabilities. Speaking with HackRead.com, Pandey emphasized the importance of rigorous access risk analysis and compliant provisioning of users.

“Automated password management alone is insufficient to secure unauthorized regulated application access risk,” Pandey said. “By focusing on stringent access risk analysis and the compliant provisioning of users, including rigorous management of third-party identities and access, organizations can significantly bolster their security posture, safeguard sensitive data, and ensure compliance with regulatory requirements. This proactive approach protects customer data and trust and enhances overall resilience.

Pandey’s comments highlight the need for organizations to go beyond basic password management and embrace a more comprehensive approach to identity security, especially given the increasing sophistication of cyberattacks.

Organizations affected by this vulnerability are encouraged to follow **Okta’s detailed guidance** to ensure no unauthorized access occurs during the timeframe in question and to adopt stronger access management practices moving forward.

1.  **Okta Breach Linked to Employee’s Google Account**
2.  **Dropbox Abused in Phishing Scam to Steal SaaS Logins**
3.  **Live Nation Confirms Massive Ticketmaster Data Breach**
4.  **LAPSUS$ Hackers Leak Trove of Data, Breach Microsoft, Okta**
5.  **Customer Used Flawed 3rd-Party Tool, Exposed Twilio Call Records**

Okta Fixes Critical Vulnerability Allowing Sign-On Policy Bypass

CISOs' cash compensation tops $400,000 now, but with the high pay comes struggles, rapidly changing responsibilities, and tight budgets.

Source: Natee Jindakum via Shutterstock

Cybersecurity professionals serving as chief information security officers (CISOs) continue to see respectable increases in pay, but not at the same rate as two years ago, and not in a way the keeps up with the changes to their responsibilities.

The average CISO now earns $403,000 in annual compensation — including salary, bonuses for reaching specific goals, and equity, such as stock options — representing a 6.4% increase over the past 12 months, according to IANS Research's "2024 CISO Compensation Report" published on Oct. 2. However, changes to the threat landscape frequently put business operations under attack, the responsibility for which falls on the shoulders of the CISO, especially following rules issued by the Securities and Exchange Commission (SEC) that requires CISOs to determine whether a breach is material within four days of discovery.

CISOs often do not have enough resources at heir disposal to do so, putting them in legal jeopardy, or, conversely, are successfully mitigating threats only to endure budget pressures because of that success, says Fred Kwong, vice president and CISO at DeVry University.

"There's this dichotomy between, Hey, Fred's doing a good job, keeping on top of the threats, mitigating the issues, \[yet\] at the same time \[he's\] asking for more resources, more money, even when they're seeing that the threat is not actualized," he explains. "We're kind of getting questioned, 'Well, do we really need another person? Do we need really need another technology or control, because it seems like you have these things handled.'"

Kwong manages a team of five other cybersecurity professionals, but continues to fight to hire a sixth — even though the organization is unlikely to approve another full-time employee.

Source: 2024 CISO Compensation Report, IANS and Artico

In 2021 and 2022, following increased remote work due to the pandemic, companies found themselves needing to secure their operations infrastructure, driving demand for CISOs — especially as cybercriminals started compromising firms and infecting their systems with ransomware. While CISOs made significant gains in compensation during the tail end of the pandemic — 44% either switched jobs or took a retention bonus in 2022 — the demand now shows signs of settling down, with only 11% doing the same in 2024, says Nick Kakolowski, senior research director at IANS Research.

"We are seeing generally a lack of movement, mostly because of macroeconomic conditions — businesses are just being conservative about hiring more," he says. "Businesses are kind of saying, We'll get by with what we have for a while. We'll hold off on hiring. We'll keep on our current path, and more CISOs are staying put, rather than taking the risk of taking on something new right now."

**CISO Mindsets: A State of Stress**

CISOs that move jobs — or are paid an incentive to stay in their current position — see the biggest increases in compensation, and CISOs for state governments are among the most likely to move. Nearly half of states hired a new CISOs in the past year, leading the average tenure of a CISO to drop from 30 months in 2022 to 23 months this year, according to the biennial Deloitte-NASCIO Cybersecurity Study.

Stress will only continue to build for CISOs in state government positions: Finding and retaining cybersecurity-skilled professionals is difficult, more sophisticated attacks — such as ransomware — have become common, and budgets continue to be tight and often hard-to-predict, says Srini Subramanian, principal with the risk and financial advisory group at consulting firm Deloitte.

Government cybersecurity professionals, which make between $125,000 to $225,000, typically do not include compensation in their Top 3 reasons for job satisfaction. Yet, increasing attacks and greater consequences for their networks, along with increased scrutiny for any outage or incident, puts them squarely in the in the eyes of the public and government officials, he says.

"The state-level systems are also dealing with ... a lot more challenges compared to a private sector systems," Subramanian says. "They have budget constraints, they have talent constraints, and now we are expanding the scope of the systems even more."

**Public Headaches, Private Stressors**

Daniel Schwalbe used to work as a security pro under the CISO at the University of Washington, a large public university, which meant that his role bridged both government and education sectors. He loved the work, and he certainly wasn't there for high pay, he says. Education CISOs are the lowest-paid of all the industries tracked by the IANS survey, with a median annual total compensation of $243,000 (the government sector was not listed).

Yet, the security work was neverending, he says.

"We had half a million devices on a network that we were supposed to protect, and I can tell you that on any given day, we pretty much figured there are 1,000 compromised devices on that network out of half a million," he says. "That's just the reality."

When he left, it wasn't about scoring a better salary, but about combatting the lack of a career path. The only position left for him to graduate to in the security career track at UW was CISO, but the current holder of that position did not intend to retire for at least three years. So, he accepted the job of deputy CISO with Farsight Security, and assumed the role of CISO at DomainTools when that company bought Farsight.

His responsibilities have changed somewhat. Compliance is more of an issue at a private firm, whereas the government and education sector have to deal with bureaucracy. Yet, making technology work better for security is a common factor, and he hopes that automation will reduce stress across the board.

"Investing a little bit upfront and tuning the alerts — so the stuff that actually comes out of your security tools is much more useful — can help," he says. "It costs money, and it's not a silver bullet, but in my opinion, it does help and can help with issues like threat analyst burnout."

**How AI Is Impacting Security**

The research firms' analyses also found that hot potato of AI risk is putting a lot of pressure on CISOs as individuals, escalating the stress. IANS Research's Kakolowski says that, typically, no one security pro in the business is really well positioned to own AI. The right person needs a blend of technical, governance, privacy, and data-science backgrounds to really help organizations fully manage the risk, he says.

Usually, CISOs do not check all those boxes, which could expose them to liability.

"CISOs are becoming the go-to person to inform AI risk decisions, and there's this pushback where CISOs say, 'Well, we can't own all of this risk, because this risk isn't owned by the business unit," he says. "'Using the tooling, we can help inform you about this risk, and we can help you understand this risk, but you have to ultimately be the ones making that decision and taking that ownership.'"

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

CISO Paychecks: Worth the Growing Security Headaches?

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in `/admin/contacts/organizations/edit/2`.

GHSA-74q2-6jp4-3rqq: Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name

Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.

GHSA-632q-77qj-c89q: LimeSurvey Cross Site Scripting vulnerability

Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.

Tag

#vulnerability