Vulnerability Summary for the Week of January 29, 2024

Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/taxstructurelist.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/countrycreate.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/statecreate.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/grnlist.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/stockissuanceprint.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/stockissuancelist.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/unitofmeasurementmodify.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/locationmodify.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/currencymodify.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/companymodify.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/stockissuancedisplay.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/taxstructurecreate.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/currencycreate.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/grnprint.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/statemodify.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/taxcodelist.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/statelist.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/taxcodecreate.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/taxstructuremodify.
Es PrimaryVendor - Product cups easy - cups easy Description A vulnerability has been reported in Cups Easy, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting vulnerability via /cupseasylive/countrymodify.


This Cyber News was published on www.cisa.gov. Publication date: Mon, 05 Feb 2024 20:43:04 +0000


Cyber News related to Vulnerability Summary for the Week of January 29, 2024

CVE-2015-2165 - Multiple cross-site scripting (XSS) vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) portal, (2) fromDate, (3) ...
5 years ago
National Cybersecurity Alliance Announces 2024 Data Privacy Week - PRESS RELEASE. WASHINGTON - Today, the National Cybersecurity Alliance, announced the program for its third annual Data Privacy Week campaign, which will take place from January 22nd to January 27th. Throughout the week, NCA will emphasize the ...
5 months ago Darkreading.com
January 2024 Patch Tuesday forecast: A Focus on Printing - This article aims to provide a quick summary of some of the latest trends, announcements, and changes associated with IT patch operations while looking at the upcoming Patch Tuesday and what software updates to expect. December 2023 Patch Tuesday ...
6 months ago Helpnetsecurity.com
Vulnerability Summary for the Week of March 11, 2024 - Published 2024-03-15 CVSS Score not yet calculated Source & Patch Info CVE-2021-47111416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 PrimaryVendor - Product linux - linux Description In the ...
3 months ago Cisa.gov
Vulnerability Summary for the Week of March 4, 2024 - Published 2024-03-06 CVSS Score not yet calculated Source & Patch Info CVE-2023-52584416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 PrimaryVendor - ...
3 months ago Cisa.gov
The Week in Ransomware - Governments struck back this week against members of ransomware operations, imposing sanctions on one threat actor and sentencing another to prison. On Tuesday, the Australian, US, and UK governments announced sanctions against Aleksandr Gennadievich ...
5 months ago Bleepingcomputer.com
The Week in Ransomware - Attacks on hospitals continued this week, with ransomware operations disrupting patient care as they force organization to respond to cyberattacks. While many, like LockBit, claim to have policies in place to avoid encryping hospitals, we continue to ...
5 months ago Bleepingcomputer.com
Ivanti urges customers to patch yet another critical vulnerability - This vulnerability only affects a limited number of supported versions-Ivanti Connect Secure, Ivanti Policy Secure version 22.5R1.1 and ZTA version 22.6R1.3. Please read between the lines that there could be unsupported versions which will never see ...
4 months ago Malwarebytes.com
$1,900 Bounty Awarded for Arbitrary Options Update Vulnerability Patched in Cookie Information - This vulnerability could be used by authenticated attackers, with authenticated access, to update arbitrary options and leverage that for privilege escalation. Props to Lucio Sá who discovered and responsibly reported this vulnerability through the ...
4 months ago Wordfence.com
Week in review: GitLab account takeover flaw, attackers exploiting Ivanti Connect Secure zero-days - Social engineer reveals effective tricks for real-world intrusionsIn this Help Net Security interview, Jayson E. Street, Chief Adversarial Officer at Secure Yeti, discusses intriguing aspects of social engineering and unconventional methods for ...
5 months ago Helpnetsecurity.com
The Top 24 Security Predictions for 2024 - Welcome to the second installment of this comprehensive annual look at global cybersecurity industry predictions from the top security industry vendors, technology magazines, expert thought leaders and many more. Last week, in part one of The Top 24 ...
6 months ago Securityboulevard.com
Cloudflare Incident on January 24th, 2023 - An Overview - On January 24th, 2023, Cloudflare experienced an incident that impacted its customers globally. In this article, we will provide an overview analysis of the incident, its impacts on SEO, security, threats, etc. ...
1 year ago Blog.cloudflare.com
Google Chrome Zero-Day Bug Under Attack, Allows Code Injection - Google has patched a high-severity zero-day bug in its Chrome Web browser that attackers are actively exploiting. The vulnerability, assigned as CVE-2024-0519, is the first Chrome zero-day bug that Google has disclosed in 2024, and the second in the ...
5 months ago Darkreading.com
ThreatDown EDR update: Streamlined Suspicious Activity investigation - Navigating the complex world of alerts just got easier, thanks to our latest enhancements to the ThreatDown Endpoint Detection and Response platform. The detailed technical information in EDR alerts-replete with complicated diagrams and references to ...
4 months ago Malwarebytes.com
Patch Now: Critical Windows Kerberos Bug Bypasses Microsoft Security - Microsoft eased enterprise security teams into 2024 with a relatively light January security update consisting of patches for 48 unique CVEs, just two of which the company identified as being of critical severity. For the second straight month, ...
5 months ago Darkreading.com
The Week in Ransomware - With it being the first week of the New Year and some still away on vacation, it has been slow with ransomware news, attacks, and new information. Last weekend, BleepingComputer tested a new decryptor for the Black Basta ransomware to show how it ...
5 months ago Bleepingcomputer.com
Microsoft January 2024 Patch Tuesday fixes 49 flaws, 12 RCE bugs - Today is Microsoft's January 2024 Patch Tuesday, which includes security updates for a total of 49 flaws and 12 remote code execution vulnerabilities. The total count of 49 flaws does not include 4 Microsoft Edge flaws fixed on January 5th. To learn ...
5 months ago Bleepingcomputer.com
It was other crims what did it: SBF off hook for FTX hack The Register - Infosec In Brief The recent indictment of a massive SIM-swapping ring may mean convicted crypto conman Sam Bankman-Fried is innocent of at least one allegation still hanging over his head: The theft of more than $400 million in crypto hacked from ...
5 months ago Go.theregister.com
Weekly Vulnerability Recap 1/29/24: Apple, Apache, & VMware - In this week's urgent updates, Apple and VMware issued updates for zero-day flaws currently under attack, and researchers detected a rise in attacks on unpatched Apache and Atlassian Confluence servers. The release of proof-of-concept code starts the ...
5 months ago Esecurityplanet.com
Ivanti US Faces Security Crisis, Threatening Worldwide Systems - In a recent development, a critical server-side request forgery vulnerability has been discovered in Ivanti Connect Secure and Ivanti Policy Secure servers, marked as CVE-2024-21893. Security experts have confirmed that this vulnerability is being ...
4 months ago Cysecurity.news
Google shares fix for Pixel phones hit by bad system update - Google has shared a temporary fix for owners of Google Pixel devices that were rendered unusable after installing the January 2024 Google Play system update. As previously reported by BleepingComputer, after the January 2024 Google Play system ...
5 months ago Bleepingcomputer.com
Porsche Abruptly Halts NFT Launch, Allowing Phishing Sites to Take Advantage - Porsche abruptly cut its minting of a new NFT collection short after a dismal turnout and backlash from the crypto community, allowing threat actors to fill the void by creating phishing sites that steal digital assets from cryptocurrency wallets. ...
1 year ago Bleepingcomputer.com
CVE-2024-37051 - GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 ...
3 weeks ago Tenable.com
Ransomware Attack Demands Reach a Staggering $5.2m in 2024 - The average extortion demand per ransomware attack was over $5.2m in the first half of 2024, according to a new analysis by Comparitech. This figure was calculated from 56 known ransom demands issued by threat actors from January-June 2024. The ...
2 days ago Infosecurity-magazine.com
Chicago children's hospital says nearly 800,000 affected by January ransomware attack - A prominent children's hospital in Chicago confirmed that almost 800,000 people had sensitive health information leaked during a ransomware attack earlier this year. The Ann & Robert H. Lurie Children's Hospital of Chicago was attacked in January by ...
6 days ago Therecord.media

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)