Vulnerabilities
Giacomo Lanzi
Magecart attack: what it is and how to protect yourself
Every day we hear about some new technology threats or vulnerabilities. Lately we talk about the data collection attack known as “Magecart”. Let’s try to understand what it is and how we can do to defend ourselves. Magecart is a large group of hackers as well as a typical attack that mainly targets online shopping carts. This type of attack…
Giacomo Lanzi
WastedLocker: Next generation ransomware
WastedLocker is ransomware attack software that began targeting businesses and other organizations in May 2020. It is known for its high ransom demands reaching millions of dollars per victim. It is the product of a group of highly skilled cyber criminals who have been operating for over a decade: Evil Corp. Who is behind WastedLocker Ransomware The group behind WastedLocker…
Giacomo Lanzi
Does ISO 27001 standard require a Pentest?
A legitimate question that often arises is whether the Penetration Test is necessary for compliance with the ISO 27001 standard. To fully understand the answer, it is necessary to clarify what is meant by these terms and to understand the relationship between all the components of the certification. ISO 27001 standard A technical standard, also incorrectly called a standard, is…
Piergiorgio Venuti
Path traversal in Photo Gallery (WordPress plugin)
Path traversal in Photo Gallery may allow admins to read most files on the filesystem (WordPress plugin)
Piergiorgio Venuti
CVE-2017-7620 Mantis Bug Tracker
CVE-2017-7620 Mantis Bug Tracker 1.3.10 / v2.3.0 CSRF Permalink Injection
Piergiorgio Venuti
WordPress Newsletter Supsystic 1.1.7
WordPress Newsletter Supsystic 1.1.7 – Cross Site Scripting Vulnerability
Piergiorgio Venuti
[CVE-2017-5868] OpenVPN Access Server
[CVE-2017-5868] OpenVPN Access Server : CRLF injection with Session fixation
Piergiorgio Venuti
Linux Kernel Privilege Escalation
SSD Advisory – Linux Kernel XFRM Privilege Escalation
Piergiorgio Venuti
SSD Advisory – Linux Kernel AF_PACKET Use-After-Free
Piergiorgio Venuti
SSD Advisory – Webmin Multiple Vulnerabilities
Piergiorgio Venuti
SSD Advisory – PHP Melody Multiple Vulnerabilities
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Ad Widget Plugin Local File Inclusion Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Simple Login Log Plugin Multiple SQL Injection Security Vulnerabilities
Piergiorgio Venuti
WordPress does not hash or expire wp_signups.activation_key allowing an attacker with SQL injection to create accounts
Piergiorgio Venuti
DefenseCode Security Advisory: Magento Commerce CSRF, Stored Cross Site Scripting #1
Piergiorgio Venuti
Exploit toolkit for CVE-2017-8759 – Microsoft .NET Framework RCE (Builder + listener + video tutorial)
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress PressForward Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Podlove Podcast Publisher Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Easy Modal Plugin Multiple Security Vulnerabilities
Piergiorgio Venuti
Stop User Enumeration allows user enumeration via the REST API (WordPress plugin)
Piergiorgio Venuti
Defense in depth — the Microsoft way (part 48): privilege escalation for dummies — they didn’t make SUCH a stupid blunder?
Piergiorgio Venuti
Multiple Local Privilege Escalation Vulnerabilities in Acunetix Web Vulnerability Scanner 11
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress AffiliateWP Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Huge-IT Video Gallery Plugin Security Vulnerability
Piergiorgio Venuti
Joomla com_tag v1.7.6 – (tag) SQL Injection Vulnerability
Piergiorgio Venuti
Qualys Security Advisory – CVE-2017-1000367 in Sudo’s get_process_ttyname() for Linux
Piergiorgio Venuti
Defense in depth — the Microsoft way (part 48): privilege escalation for dummies — they didn’t make SUCH a stupid blunder?
Piergiorgio Venuti
Microsoft Dynamic CRM 2016 – Cross-Site Scripting vulnerability
Piergiorgio Venuti
Executable installers are vulnerable^WEVIL (case 52): escalation of privilege with Microsoft’s .NET Framework installers
Piergiorgio Venuti
Reflected XSS in WordPress Download Manager could allow an attacker to do almost anything an admin can (WordPress plugin)
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress All In One Schema.org Rich Snippets Plugin Security Vulnerability
Piergiorgio Venuti
[CVE-2017-5868] OpenVPN Access Server : CRLF injection with Session fixation
Piergiorgio Venuti
Stealing Windows Credentials Using Google Chrome
Piergiorgio Venuti
WordPress EELV Newsletter v4.5 – Multiple Vulnerabilities
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: GOOGLE google-api-php-client Multiple Security Vulnerabilities
Piergiorgio Venuti
DefenseCode WebScanner DAST Advisory: WordPress User Access Manager Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Tracking Code Manager Plugin Multiple Security Vulnerabilities
Piergiorgio Venuti
CSRF in wordpress plugin clean login allows remote attacker change wordpress login redirect url or logout redirect url to evil address
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress WebDorado Gallery Plugin SQL Injection Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Spider Event Calendar Plugin SQL Injection Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Facebook Plugin SQL Injection Vulnerability
Alessandro Stesi
Cross-Site Scripting vulnerability in Trust Form WordPress Plugin
Piergiorgio Venuti
Popup by Supsystic WordPress plugin vulnerable to Cross-Site Request Forgery
Piergiorgio Venuti
Stored Cross-Site Scripting vulnerability in User Login Log WordPress Plugin
Piergiorgio Venuti
Cross-Site Request Forgery & Cross-Site Scripting in Contact Form Manager WordPress Plugin
Piergiorgio Venuti
Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin
Piergiorgio Venuti
Remote file upload vulnerability in WordPress Plugin Mobile App Native 3.0
Piergiorgio Venuti
Cross-Site Request Forgery in WordPress Press This function allows DoS
Alessandro Stesi
Persistent Cross-Site Scripting in the WordPress NewStatPress plugin
Alessandro Stesi
Cross-Site Request Forgery in Atahualpa WordPress Theme
Alessandro Stesi
Cross-Site Scripting in Magic Fields 1 WordPress Plugin
Alessandro Stesi
Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin
Alessandro Stesi
WordPress Adminer plugin allows public (local) database login
Alessandro Stesi
Cross-Site Request Forgery in WordPress Download Manager Plugin
Alessandro Stesi
Simple Ads Manager WordPress plugin unauthenticated PHP Object injection vulnerability
Alessandro Stesi
Cross-Site Request Forgery in Global Content Blocks WordPress Plugin
Alessandro Stesi
Cross-Site Request Forgery in File Manager WordPress plugin
Alessandro Stesi
Cross-Site Scripting vulnerability in WP-Filebase Download Manager WordPress Plugin
Alessandro Stesi
Admin Custom Login WordPress plugin custom login page affected by persistent Cross-Site Scripting
Alessandro Stesi
Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field
Alessandro Stesi
Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability
Alessandro Stesi
WordPress Plugin Kama Click Counter 3.4.9 – Blind SQL Injection
Alessandro Stesi
WordPress Plugin Easy Table 1.6 – Persistent Cross-Site Scripting
Alessandro Stesi
Persistent Cross-Site Scripting vulnerability in User Access Manager WordPress Plugin
Alessandro Stesi
Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification
Alessandro Stesi
CMS Commander Client WordPress Plugin unauthenticated PHP Object injection vulnerability
Alessandro Stesi
New exploit for new vulnerability in WordPress Plugin + tutorial
Alessandro Stesi
Nginx (Debian-based + Gentoo distros) – Root Privilege Escalation [CVE-2016-1247 UPDATE]
Alessandro Stesi
Multiple vulnerabilities in cPanel <= 60.0.34
Piergiorgio Venuti
MySQL / MariaDB / PerconaDB – Privilege Escalation / Race Condition Exploit [CVE-2016-6663 / OCVE-2016-5616]
Piergiorgio Venuti
Cross-Site Scripting in Check Email WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting in All In One WP Security & Firewall WordPress Plugin
Piergiorgio Venuti
Nginx (Debian-based distros) – Root Privilege Escalation Vulnerability (CVE-2016-1247)
Piergiorgio Venuti
Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting in Calendar WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting vulnerability in Quotes Collection WordPress Plugin
Piergiorgio Venuti
MySQL / MariaDB / PerconaDB – Root Privilege Escalation Exploit ( CVE-2016-6664 / CVE-2016-5617 )
Piergiorgio Venuti
[oss-security] CVE request:Lynx invalid URL parsing with ‘?’
Share
RSS
More Articles…
- CIS Controls and Vulnerability Assessment: practical guide to adopting best practices
- Kerberoasting: a threat to cybersecurity and how to mitigate it with Security Posture analysis
- Protect Your Business: Antivirus vs. SOC Service with EDR and Next Generation Antivirus (NGA)
- CSIRT and SOC: Differences between incident management and security monitoring
- Security posture analysis: Complete guide to strengthening cybersecurity
- Deception vs EDR: What’s the Best Threat Defense Strategy?
- Deception: Tricking Hackers to Secure Your Network
- Active Defense Deception: cybersecurity that beats hackers with their own weapons
Categories …
- Backup as a Service (17)
- Acronis Cloud Backup (11)
- Veeam Cloud Connect (4)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (22)
- Conferenza Cloud (4)
- ICT Monitoring (5)
- Log Management (2)
- News (21)
- ownCloud (4)
- Privacy (7)
- Secure Online Desktop (14)
- Security (189)
- Cyber Threat Intelligence (CTI) (7)
- Deception (4)
- Ethical Phishing (9)
- Penetration Test (8)
- Posture Guard (1)
- SOCaaS (62)
- Vulnerabilities (84)
- Web Hosting (15)
Tags
Acronis Cloud Backup
BaaS
Backup
cloud
cloud computing
Cloud Conference
cloud provider reggio emilia
cloud server
cloud services
cyber security
cyber security
cyber threat
Cyber Threat Hunter
Data Exfiltration
GDPR
Log Management
Machine Learning
Monitoraggio infrastruttura ICT
Next Generation SIEM
nextgen siem
owncloud
owncloud
pentest
Phishing
Plesk
Ransomware
Ransomware
security
Security Information and Event Management
server virtuale
sicurezza
siem
Smart Working
SOAR
SOCaaS
Threat intelligence
UEBA
VDS
Virtual Machine
vps
vulnerability assessment
webinar
web security
Wordpress
Zabbix as a Service
Dark Reading
- Don't Get Burned by CAPTCHAs: A Recipe for Accurate Bot Protection September 25, 2023Traditional CAPTCHAs, such as reCAPTCHA, no longer protect online businesses adequately. Real users hate them. Bots bypass them. It's time to upgrade.
- ASPM Is Good, But It's Not a Cure-All for App Security September 23, 2023What application security posture management does, it does well. But you'll still need to fill in some holes, especially concerning API security.
- Recast Software Acquires Liquit, Consolidating the Endpoint and Application Management Markets September 22, 2023
- ClassLink Provides Cybersecurity Training Course to Help Schools Protect Public Directory Data September 22, 2023
- Wing Security Launches Compliance-Grade SaaS Security Solution for Just $1.5K September 22, 2023
- Latest Acquisition Powers AI-based Network Detection and Response and Open XDR Capabilities for WatchGuard September 22, 2023
- TikTok API Rules Stymie Analysis of US User Data, Academics Say September 22, 2023Terms of service for API access give TikTok publication review over findings and limit access to critical data on the platform's impact on US users, researchers say.
- Hackers Let Loose on Voting Gear Ahead of US Election Season September 22, 2023Ethical hackers were given voluntary access to digital scanners, ballot markers, and electronic pollbooks, all in the name of making the voting process more resilient to cyber threats.
- Akira Ransomware Mutates to Target Linux Systems, Adds TTPs September 22, 2023The newly emerged ransomware actively targets both Windows and Linux systems with a double-extortion approach.
- NFL, CISA Look to Intercept Cyber Threats to Super Bowl LVIII September 22, 2023The league is working with more than 100 partners to workshop responses to a host of hypothetical cyberattacks on the upcoming Big Game in Las Vegas.
Full Disclosure
- APPLE-SA-2023-09-21-6 macOS Ventura 13.6 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-6 macOS Ventura 13.6 macOS Ventura 13.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213931. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Additional CVE entries coming soon. Kernel Available for: macOS […]
- APPLE-SA-2023-09-21-7 macOS Monterey 12.7 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-7 macOS Monterey 12.7 macOS Monterey 12.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213932. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Additional CVE entries coming soon. Kernel Available for: macOS […]
- APPLE-SA-2023-09-21-5 watchOS 9.6.3 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-5 watchOS 9.6.3 watchOS 9.6.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213929. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Kernel Available for: Apple Watch Series 4 and later Impact: A […]
- APPLE-SA-2023-09-21-4 watchOS 10.0.1 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-4 watchOS 10.0.1 watchOS 10.0.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213928. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Kernel Available for: Apple Watch Series 4 and later Impact: A […]
- APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7 iOS 16.7 and iPadOS 16.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213927. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Additional CVE entries coming soon. […]
- APPLE-SA-2023-09-21-2 iOS 17.0.1 and iPadOS 17.0.1 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-2 iOS 17.0.1 and iPadOS 17.0.1 iOS 17.0.1 and iPadOS 17.0.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213926. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Kernel Available for: iPhone XS […]
- APPLE-SA-2023-09-21-1 Safari 16.6.1 September 23, 2023Posted by Apple Product Security via Fulldisclosure on Sep 22APPLE-SA-2023-09-21-1 Safari 16.6.1 Safari 16.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213930. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. WebKit Available for: macOS Big Sur and Monterey Impact: Processing web […]
- Advisory X41-2023-001: Two Vulnerabilities in OPNsense September 23, 2023Posted by X41 D-Sec GmbH Advisories via Fulldisclosure on Sep 22Advisory X41-2023-001: Two Vulnerabilities in OPNsense =========================================================== Highest Severity Rating: High Confirmed Affected Versions: 23.1.11_1, 23.7.3, 23.7.4 Confirmed Patched Versions: Commit 484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7 Vendor: Deciso B.V. / OPNsense Vendor URL: https://opnsense.org Credit: X41 D-Sec GmbH, Yasar Klawohn and JM Status: Public Advisory-URL:...
- SEC Consult SA-20230918-0 :: Authenticated Remote Code Execution and Missing Authentication in Atos Unify OpenScape September 18, 2023Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 18SEC Consult Vulnerability Lab Security Advisory < 20230918-0 > ======================================================================= title: Authenticated Remote Code Execution and Missing Authentication product: Atos Unify OpenScape Session Border Controller Atos Unify OpenScape Branch Atos Unify OpenScape BCF vulnerable version: OpenScape SBC...
- SEC Consult SA-20230829-0 :: Reflected Cross-Site Scripting (XSS) in PTC - Codebeamer (ALM Solution) September 18, 2023Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 18SEC Consult Vulnerability Lab Security Advisory < 20230829-0 > ======================================================================= title: Reflected Cross-Site Scripting (XSS) product: PTC - Codebeamer (ALM Solution) vulnerable version: =21.09-SP14 CVE number: CVE-2023-4296...
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
Products and Solutions
Partners
Cloud Models
News
- CIS Controls and Vulnerability Assessment: practical guide to adopting best practices September 25, 2023
- Kerberoasting: a threat to cybersecurity and how to mitigate it with Security Posture analysis September 8, 2023
- Protect Your Business: Antivirus vs. SOC Service with EDR and Next Generation Antivirus (NGA) September 8, 2023
- CSIRT and SOC: Differences between incident management and security monitoring September 8, 2023
- Security posture analysis: Complete guide to strengthening cybersecurity August 21, 2023
Google Reviews
Omid Fazeli
06:59 20 Apr 18
They have a lot of solutions for any... kind of business. Lower prices than many others. The support service is always active and efficient.read more
Paolo Raimondi
2018-04-21T11:06:26+0000
La Polimatica Progetti Srl, azienda di... cui sono titolare, collabora con soddisfazione da alcuni anni con Secure Online Desktop. L'Azienda è costituita da professionisti seri e competenti. Insieme a loro abbiamo costruito un sistema organizzato di soluzioni ICT, servizi e attività di consulenza per la compliance alla normativa in materia di protezione dei dati personali (GDPR).read more
Ilaria Miglietta
2018-04-21T04:16:37+0000
Servizi affidabili e di semplice... utilizzo. I loro tecnici molto attenti alle esigenze del cliente, continuate cosìread more
Francesca Marastoni
2018-04-20T11:41:31+0000
Excellent service company with... wonderful stuff. Highly recommended.
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Alessio Liga
2018-04-20T08:25:22+0000
Servizi di alto livello, competenti e... disponibili a accettare nuove sfide per sviluppare business
Ottimo supportoread more
Matteo Revelli
2018-04-19T22:39:41+0000
Ottima azienda, offre servizi di alta... qualità con personale competente e disponibile.read more
Lorenzo Munari
2018-04-19T16:25:10+0000
Azienda molto seria e affidabile.
E'... un piacere poter collaborare con realtà di questo tiporead more
Francisco Amadi
2018-04-19T10:41:17+0000
Ho avuto il piacere di collaborare con... loro e spero vivamente che succeda di nuovo. Competenti, professionali, precisi e cordiali!read more
Davide Michelotto
2018-04-19T07:42:23+0000
Ottimo servizio, seri professionisti al... timone della società e celerità nei tempi di risposta, oltre ogni aspettativa.read more
Luca Prati
2018-04-18T10:12:13+0000
Azienda eccellente, consulenza... customizzata e puntuale.
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2023 Secure Online Desktop s.r.l. All Rights Reserved. Registered Office: via dell'Annunciata 27 – 20121 Milan (MI), Operational Office: via statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Tax code and VAT number 07485920966 – R.E.A. MI-1962358 Privacy Policy - ISO Certifications