Security Advisory: news, advisories and analysis, page 7

Coverage, page 7

• 

  Threats·Cloud & SaaSCritical

  EnergizeLab Station Middleware Exposes Admin APIs Without Role Checks

  EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.

  CST Editorial Desk16 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  EnergizeLab Eilik AI Inference Services Expose Model Admin Without Authentication

  The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.

  CST Editorial Desk16 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  Atlassian Data Center Flaw Spanning Jira, Confluence and Bitbucket Exploited

  This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data…

  CST Editorial Desk16 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  Amelia Booking Plugin SQL Injection Puts WordPress Sites at Risk

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL…

  CST Editorial Desk16 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  QNAP Qsirch Path Traversal Flaw Disclosed

  A path traversal vulnerability has been reported to affect Qsirch.

  CST Editorial Desk16 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  Cisco Secure Email Gateway AMP Flaw Exploited for Unauthenticated File Writes

  A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write…

  CST Editorial Desk15 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  QNAP HybridDesk Station OS Command Injection Flaw Disclosed

  An OS command injection vulnerability has been reported to affect HybridDesk Station.

  CST Editorial Desk15 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  FluentCRM WordPress Plugin Privilege Escalation Flaw Disclosed

  Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM:…

  CST Editorial Desk15 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  AhsayCBS Backup Server Command Injection Exploited in Attacks

  A flaw has been found in Ahsay AhsayCBS up to 10.3.2.

  CST Editorial Desk15 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  Mitsubishi Electric GENESIS Password Recovery Flaw Puts SCADA Accounts at Risk

  Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions…

  CST Editorial Desk15 Oct 20267 min read
• 

  Threats·Cloud & SaaSCritical

  Mitsubishi Electric GENESIS64 and ICONICS Suite Privilege Assignment Flaw Disclosed

  Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior,…

  CST Editorial Desk15 Oct 20267 min read