News & Sicurezza

Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally.

Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network.

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.

The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

[PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]

Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering a legitimate user to import a specially crafted trace file

Zoom Workplace for Windows Vulnerabilities Allow Privilege Escalation Zoom has released four security bulletins on March 10, 2026, disclosing multiple vulnerabilities across its Windows-based client suite. The flaws, ranging from High to Critical severity, could allow a ... Read more Published Date: Mar 10, 2026 (23 hours, 5 minutes ago) Vulnerabilities has been mentioned in this article.

Fortinet FortiManager fgtupdates Vulnerability Allows Attackers to Execute Malicious Commands Fortinet has disclosed a high-severity stack-based buffer overflow vulnerability in its FortiManager platform that could allow remote unauthenticated attackers to execute unauthorized commands. Tracke ... Read more Published Date: Mar 10, 2026 (21 hours, 12 minutes ago) Vulnerabilities has been mentioned in this article.

The March 2026 Security Update Review I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled ... Read more Published Date: Mar 10, 2026 (21 hours, 20 minutes ago) Vulnerabilities has been mentioned in this article.

The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.