Matthias Held

What Secrets Does Pentester Land Hold In Its Written Content? What Secrets Does Pentester Land Hold In Its Written Content? What Does Pentester Land Written Content Offer? What Bug Bounty News Can Pentester Land Offer? What Skills Do You Need to Succeed on Pentester Land? If you are interested in receiving Pentester Land written content, you've come to the right place. In this article, you'll learn what PentesterLand's community newsletter is all about. The Bug Bytes newsletter is a weekly newsletter from PentesterLand and covers each week. The Bug Bytes newsletter also covers NahamCon, which is the ultimate bug-hunting convention. To read more, go to: https://lnkd.in/eq8VYbBQ

🚨SECURITY ALERT: CVE-2024-34128 Adobe Experience Manager, version from 6.5.0 to 6.5.20🚨 📝 CVE DETAILS: - 🆔 Vulnerability: CVE-2024-34128 - 🔥 Severity: Medium - 📉 CVSS Score: 5.4 - 🎯 Exploit Probability EPSS: The EPSS for this CVE has not been published yet. - 📜 Status according to CISA: Not actively exploited vulnerability. - 🛠️ Exploit: No exploit on GitHub or ExploitDB. - 🛡️ IoCs: No IoCs associated - 📅 Publication Date: 24/07/2024 03:40 UTC 🔍 EXPLANATION AND MITIGATION: Cause of the Vulnerability: The vulnerability stems from insufficient input validation in the affected versions of Adobe Experience Manager. Specifically, malicious scripts can be injected into certain form fields on vulnerable pages, allowing an attacker to execute arbitrary code in a victim's browser. Steps for Mitigation: 1. Update to the latest version: Adobe has released a security update that addresses this vulnerability. Update to Adobe Experience Manager version 6.5.21 or later as soon as possible. 2. Disable vulnerable form fields: If updating is not immediately feasible, disable any form fields that are vulnerable to XSS attacks. This can be done by removing the vulnerable fields from the page or modifying the code to prevent malicious input. 3. Implement input validation: Ensure that all user input is properly validated to prevent the injection of malicious scripts. This can be done by using a combination of server-side and client-side validation techniques. 4. Enable XSS protection mechanisms: Configure your web application to enable XSS protection mechanisms such as HTTP headers e.g., Content-Security-Policy and browser-based XSS filters. 5. Monitor for suspicious activity: Regularly monitor your web application for any suspicious activity that may indicate an XSS attack. This can be done by reviewing logs and using security monitoring tools. 📈 TECHNICAL IMPACT: Attack Vector: Network access, Internet. Attack Complexity: Easy to exploit, does not require special skills. Privileges Required: Requires some limited privileges. User Interaction: Requires the user to perform some action, like clicking a link. Scope: Can affect other connected systems. Confidentiality: May reveal limited information. Integrity: May modify data in a limited way. Availability: Does not affect system availability. 🔗 STAY SAFE AND INFORMED #CVE-2024-34128 #MEDIUM #Adobe Experience Manager #version from 6.5.0 to 6.5.20 #CyberSecurity #InfoSec #Vulnerability #CVE #TechNews #AI #Automation

🚨 SECURITY ALERT: CVE-2024-6365 🚨 📝 CVE DETAILS: - 🆔 Vulnerability: CVE-2024-6365 - 🔥 Severity: Critical - 📉 CVSS Score: 9.8 - 🎯 Exploit Probability EPSS: No data found for the specified CVE ID. - 📜 Status according to CISA: Not actively exploited vulnerability. - 🛠️ Exploit: No exploit on GitHub or ExploitDB. - 🛡️ IoCs: No IoCs associated - 📅 Publication Date: 09/07/2024 07:13 UTC - 🖥️ Vulnerable Software: Product Table by WBW plugin for WordPress version < 2.0.2 🔍 EXPLANATION AND MITIGATION: 1. Cause of the Vulnerability: The Product Table by WBW plugin for WordPress lacks proper authorization and input sanitization in the 'saveCustomTitle' function. This allows attackers to send malicious input that can be executed as code on the server. 2. Steps for Mitigation: 1. Update the Plugin: Update the Product Table by WBW plugin to version 2.0.2 or later. 2. Manual Patch if updating is not possible: Open the file `languages/customTitle.php` in your WordPress installation. Locate the following line: ``` $wpdb->query$query; ``` Replace it with: ``` $wpdb->prepare$query; ``` Save the file. 3. Additional Security Measures: Implement a web application firewall to block malicious requests. Use a security scanner to regularly check for vulnerabilities. Keep WordPress and all plugins up to date. 📈 TECHNICAL IMPACT: Attack Vector: Network access, Internet. Attack Complexity: Easy to exploit, does not require special skills. Privileges Required: Does not need special privileges to be exploited. User Interaction: No user interaction needed, can occur in the background. Scope: Does not spread to other systems Confidentiality: May reveal sensitive and critical information. Integrity: May modify or destroy important data. Availability: May cause the system to stop working completely. 🔗 STAY SAFE AND INFORMED #CyberSecurity #InfoSec #Vulnerability #CVE #TechNews #AI #Automation

Exploitation Attempts Target New MOVEit Transfer Vulnerability: Exploitation attempts targeting CVE-2024-5806, a critical MOVEit Transfer vulnerability patched recently, have started. The post Exploitation Attempts Target New MOVEit Transfer Vulnerability appeared first on SecurityWeek.

🚨 SECURITY ALERT: CVE-2024-3080 🚨 📝 CVE DETAILS: - 🆔 Vulnerability: CVE-2024-3080 - 🔥 Severity: Critical - 📉 CVSS Score: 9.8 - 🎯 Exploit Probability EPSS: 39.274 % - 📜 Status according to CISA: Not actively exploited vulnerability. - 🛠️ Exploit: No exploit on GitHub or ExploitDB. - 🛡️ IoCs: No IoCs associated - 📅 Publication Date: 09/07/2024 07:31 UTC - 🖥️ Vulnerable Software: ASUS router, firmware versions prior to 3.0.0.4.386.49710 🔍 EXPLANATION AND MITIGATION: 1. Cause of the Vulnerability: The vulnerability arises because the ASUS router does not properly verify the user's credentials before allowing them to log in. This allows an attacker to bypass the authentication process and gain access to the router's settings without providing a valid username or password. 2. Steps for Mitigation: 1. Update the router's firmware: ASUS has released a firmware update that addresses this vulnerability. Visit the ASUS support website to download and install the latest firmware for your router model. 2. Enable two-factor authentication 2FA: If available, enable 2FA on your router. This requires you to provide an additional code sent to your phone or email when logging in, making it more difficult for attackers to gain unauthorized access. 3. Use a strong password: Set a strong password for your router that is at least 12 characters long and includes a combination of uppercase and lowercase letters, numbers, and symbols. 4. Disable remote management: If you do not need to access your router remotely, disable remote management features to prevent attackers from exploiting this vulnerability over the internet. 5. Change the default IP address: The default IP address of ASUS routers is often known to attackers. Change the IP address to a less common one to make it harder for attackers to target your router. 6. Keep your router updated: Regularly check for and install firmware updates from ASUS to ensure your router is protected against the latest vulnerabilities. 📈 TECHNICAL IMPACT: Attack Vector: Network access, Internet. Attack Complexity: Easy to exploit, does not require special skills. Privileges Required: Does not need special privileges to be exploited. User Interaction: No user interaction needed, can occur in the background. Scope: Does not spread to other systems Confidentiality: May reveal sensitive and critical information. Integrity: May modify or destroy important data. Availability: May cause the system to stop working completely. 🔗 STAY SAFE AND INFORMED #CyberSecurity #InfoSec #Vulnerability #CVE #TechNews #AI #Automation

🚨 SECURITY ALERT: CVE-2024-38512 - XCC Firmware 🚨 📝 CVE DETAILS: - 🆔 Vulnerability: CVE-2024-38512 - 🔥 Severity: High - 📉 CVSS Score: 7.2 - 🎯 Exploit Probability EPSS: The EPSS for this CVE has not been published yet. - 📜 Status according to CISA: Not actively exploited vulnerability. - 🛠️ Exploit: No exploit on GitHub or ExploitDB. - 🛡️ IoCs: No IoCs associated - 📅 Publication Date: 26/07/2024 20:35 UTC - 🖥️ Vulnerable Software: XCC Firmware 🔍 EXPLANATION AND MITIGATION: 1. Cause of the Vulnerability: The vulnerability arises due to insufficient input validation in XCC. When a user with elevated privileges sends specially crafted IPMI commands, the system fails to properly validate the input, allowing the attacker to inject malicious commands and gain unauthorized access. 2. Steps for Mitigation: 1. Update XCC Firmware: - Download the latest XCC firmware from the manufacturer's website. - Follow the manufacturer's instructions to update the firmware. 2. Disable IPMI Over LAN Optional: - Log in to the XCC web interface. - Navigate to "Networking" "IPMI Over LAN". - Disable the "IPMI Over LAN" option. 3. Configure IPMI User Privileges: - Log in to the XCC web interface. - Navigate to "Security" "Users". - For each user with elevated privileges, ensure that the "IPMI" privilege is set to "None". 4. Enable XCC Secure Boot Optional: - Log in to the XCC web interface. - Navigate to "Security" "Secure Boot". - Enable the "Secure Boot" option. 5. Implement Network Segmentation: - Isolate the XCC management network from other sensitive systems. - Use firewalls to restrict access to the XCC management network only to authorized personnel. 📈 TECHNICAL IMPACT: Attack Vector: Network access, Internet. Attack Complexity: Easy to exploit, does not require special skills. Privileges Required: Requires administrative privileges. User Interaction: No user interaction needed, can occur in the background. Scope: Does not spread to other systems Confidentiality: May reveal sensitive and critical information. Integrity: May modify or destroy important data. Availability: May cause the system to stop working completely. 🔗 STAY SAFE AND INFORMED #XCCFirmware #CyberSecurity #InfoSec #Vulnerability #TechNews #AI #Automation

🔥Medium Risk Vulnerability Alert🔥: OpaMiddleware, a popular middleware for FastAPI, has a security misconfiguration that allows all HTTP OPTIONS requests without evaluating it against any policy. This could potentially allow an unauthenticated attacker to discover which entities exist within an application. CVE number is pending. Remember, API security is crucial! #OpaMiddleware #FastAPI #SecurityMisconfiguration #OWASP #APIsecurity https://lnkd.in/e-JdShDa