#auth

Ubuntu Security Notice 6991-1 - It was discovered that AIOHTTP did not properly restrict file access when the 'follow_symlinks' option was set to True. A remote attacker could possibly use this issue to access unauthorized files on the system.

Travel version 1.0 suffers from a remote shell upload vulnerability.

Webpay E-Commerce version 1.0 suffers from an ignored default credential vulnerability.

SPIP version 4.2.12 suffers from a code execution vulnerability.

Online Sports Complex Booking System version 1.0 suffers from an ignored default credential vulnerability.

Online Shopping Portal Project version 2.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

Online Pizza Ordering System version 1.0 suffers from an ignored default credential vulnerability.

File Management System version 1.0 suffers from an insecure direct object reference vulnerability.

Talos' Nick Biasini discusses the biggest shifts and trends in the threat landscape so far. We also focus on one state sponsored actor that has been particularly active this year, and talk about why defenders need to be paying closer attention to infostealers.

Cybersecurity researchers have discovered yet another critical security flaw in the LiteSpeed Cache plugin for WordPress that could allow unauthenticated users to take control of arbitrary accounts. The vulnerability, tracked as CVE-2024-44000 (CVSS score: 7.5), impacts versions before and including 6.4.1. It has been addressed in version 6.5.0.1.  "The plugin suffers from an