CyberPulse Cybersecurity News, with Source Links
FA
CERT/CC Vulnerability Notes

VU#385711: PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability

Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file. Successful exploitation could allow arbitrary code execution with the privileges of the PHP process. Description Prest…

Vulnerabilities & Zero-Day Databases Open Source
Read the full article at CERT/CC Vulnerability Notes Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →
CERT/CC Vulnerability Notes

VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities

Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices. Exploitation may enable an attacker to remotely control the rover, access audiovisual streams, or pivot into the user’s network. Description The FrodoBots EarthRo…

Vulnerabilities & Zero-Day IoT & OT Security Web Development
Source
Security Affairs

QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices

Taiwanese vendor QNAP urges users to update Plex Media Server after reports of NAS compromises through the Plex2Shell vulnerability chain. QNAP urges users to update Plex Media Server through the QNAP App Center after reports that threat actors exploited the Plex2Shell vulnerability chain to compromise NAS devices. “QNAP has received reports from some users that […]

Malware & Threats Vulnerabilities & Zero-Day IoT & OT Security
Source
Qualys Blog

The Expanding Attack Surface Demands a New Operating Model

Why the Risk Operations Center Is Becoming the System of Record for Proactive Enterprise Risk Reduction The cybersecurity industry has spent years improving how we discover vulnerabilities. The challenge now is no longer finding risk. It is reducing risk faster than adversaries can exploit it. The PHP2Shell vulnerabilities disclosed in October are a reminder of […]

Vulnerabilities & Zero-Day
Source