#information-disclosure

[ follow ]
#trytond #traceback #security-update #cybercrime #windows-gdi-vulnerabilities #patch-management #sitecore
fromTryton Discussion
1 week ago

Security Release for issue #14354

Mahdi Afshar and Abdulfatah Abdillahi have found that trytond sends the trace-back to the clients for unexpected errors. This trace-back may leak information about the server setup. Impact CVSS v3.0 Base Score: 4.3 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None Workaround A possible workaround is to configure an error handler which would remove the trace-back from the response. Resolution All affected users should upgrade trytond to the latest version.
Information security
Information security
fromThe Hacker News
3 weeks ago

ThreatsDay Bulletin: AI Tools in Malware, Botnets, GDI Flaws, Election Attacks & More

Digital vulnerabilities now translate into real-world harm as scams, rented cyber violence, and compromised apps turn digital weaknesses into physical, economic, and political threats.
fromThe Hacker News
3 months ago

Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution

CVE-2025-53693 - HTML cache poisoning through unsafe reflections CVE-2025-53691 - Remote code execution (RCE) through insecure deserialization CVE-2025-53694 - Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach Patches for the first two shortcomings were released by Sitecore in June and for the third in July 2025, with the company stating that "successful exploitation of the related vulnerabilities might lead to remote code execution and non-authorized access to information."
Information security
[ Load more ]