#web

PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.

Hello everyone! October was an interesting and busy month for me. I started a new job, worked on my open source Vulristics project, and analyzed vulnerabilities using it. Especially Linux vulnerabilities as part of my new Linux Patch Wednesday project. And, of course, analyzed Microsoft Patch Tuesday as well. In addition, at the end of […]

LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices use cleartext HTTP for login.

kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initContent().

By Deeba Ahmed Beware of Provocative Facebook Ads, Warn Researchers! This is a post from HackRead.com Read the original post: Provocative Facebook Ads Leveraged to Deliver NodeStealer Malware

By Deeba Ahmed BrickLink confirms probing into unusual activity. This is a post from HackRead.com Read the original post: LEGO Marketplace BrickLink Hacked? Website Down Amid Unusual Activity

Identity and authentication management provider Okta on Friday disclosed that the recent support case management system breach affected 134 of its 18,400 customers. It further noted that the unauthorized intruder gained access to its systems from September 28 to October 17, 2023, and ultimately accessed HAR files containing session tokens that could be used for session hijacking attacks. "The

By Waqas The hackers are selling the trove of data for $50,000 in Bitcoin (BTC) or Monero (XMR) cryptocurrency. This is a post from HackRead.com Read the original post: Russia’s 2nd-Largest Insurer Rosgosstrakh Hacked; 400GB of Data Sold Online

Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability

A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later