WordPress Infinite Scroll – Ajax Load More Security Vulnerabilities

CVE-2021-47617

In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot...

CVE-2021-47617

In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot...

CVE-2022-48734 btrfs: fix deadlock between quota disable and qgroup rescan worker

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between quota disable and qgroup rescan worker Quota disable ioctl starts a transaction before waiting for the qgroup rescan worker completes. However, this wait can be infinite and results in deadlock because.....

CVE-2022-48734 btrfs: fix deadlock between quota disable and qgroup rescan worker

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between quota disable and qgroup rescan worker Quota disable ioctl starts a transaction before waiting for the qgroup rescan worker completes. However, this wait can be infinite and results in deadlock because.....

Secure Your Containerized Environments with Qualys Containerized Scanner Appliance (QCSA)

IT has undergone a series of significant shifts over the years, from physical infrastructure to virtual, and how infrastructure was managed and maintained. This shift led IT through the digital transformation era, introducing various types of clouds and “As-a-Service” models. Although...

CVE-2021-47617 PCI: pciehp: Fix infinite loop in IRQ handler upon power fault

In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot...

Tool Overload: Why MSPs Are Still Drowning with Countless Cybersecurity Tools in 2024

Highlights Complex Tool Landscape: Explore the wide array of cybersecurity tools used by MSPs, highlighting the common challenge of managing multiple systems that may overlap in functionality but lack integration. Top Cybersecurity Challenges: Discuss the main challenges MSPs face, including...

Chinese Cyber Espionage Targets Telecom Operators in Asia Since 2021

Cyber espionage groups associated with China have been linked to a long-running campaign that has infiltrated several telecom operators located in a single Asian country at least since 2021. "The attackers placed backdoors on the networks of targeted companies and also attempted to steal...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: kubescape, minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, skopeo, argo-cd, grafana, rqlite, spicedb, temporal-server, ctop, istio-cni, clusterctl, cri-tools, kor, kubernetes-csi-livenessprobe, trillian,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: kubescape, ip-masq-agent, skopeo, dataplaneapi, yam, rqlite, litestream, spicedb, clusterctl, crane, aws-flb-firehose, neuvector-scanner, prometheus-redis-exporter, external-dns, hubble, crossplane-provider-aws, prometheus-postgres-exporter, argo-workflows,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: kubescape, ip-masq-agent, skopeo, dataplaneapi, yam, litestream, spicedb, ctop, clusterctl, crane, aws-flb-firehose, neuvector-scanner, prometheus-redis-exporter, external-dns, crossplane-provider-aws, grafana-mimir, prometheus-postgres-exporter, argo-workflows,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, prometheus-pushgateway, kubernetes-dashboard, argo-cd, rqlite, kubernetes-csi-livenessprobe, trillian, external-dns, k3s, kubernetes-csi-external-snapshotter, crossplane-provider-aws, aactl,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubescape, minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, skopeo, argo-cd, grafana, rqlite, spicedb, temporal-server, ctop, istio-cni, clusterctl, cri-tools, kor, kubernetes-csi-livenessprobe, trillian,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: kubescape, ip-masq-agent, skopeo, dataplaneapi, yam, rqlite, litestream, spicedb, clusterctl, crane, aws-flb-firehose, neuvector-scanner, prometheus-redis-exporter, external-dns, hubble, crossplane-provider-aws, prometheus-postgres-exporter, argo-workflows,...

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: kubescape, ip-masq-agent, skopeo, dataplaneapi, yam, litestream, spicedb, ctop, clusterctl, crane, aws-flb-firehose, neuvector-scanner, prometheus-redis-exporter, external-dns, crossplane-provider-aws, grafana-mimir, prometheus-postgres-exporter, argo-workflows,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: kubescape, minio, aws-ebs-csi-driver, flux-helm-controller, prometheus-pushgateway, kubernetes-dashboard, argo-cd, rqlite, istio-cni, kubernetes-csi-livenessprobe, trillian, external-dns, k3s, kubernetes-csi-external-snapshotter, crossplane-provider-aws, aactl,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: kubescape, ip-masq-agent, skopeo, dataplaneapi, yam, litestream, spicedb, ctop, clusterctl, crane, aws-flb-firehose, neuvector-scanner, prometheus-redis-exporter, external-dns, crossplane-provider-aws, grafana-mimir, prometheus-postgres-exporter, argo-workflows,...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, prometheus-pushgateway, kubernetes-dashboard, argo-cd, rqlite, kubernetes-csi-livenessprobe, trillian, external-dns, k3s, kubernetes-csi-external-snapshotter, crossplane-provider-aws, aactl,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kubescape, minio, aws-ebs-csi-driver, flux-helm-controller, prometheus-pushgateway, kubernetes-dashboard, argo-cd, rqlite, istio-cni, kubernetes-csi-livenessprobe, trillian, external-dns, k3s, kubernetes-csi-external-snapshotter, crossplane-provider-aws, aactl,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

GHSA-236W-P7WF-5PH8 vulnerabilities

Vulnerabilities for packages: kubescape, ip-masq-agent, skopeo, dataplaneapi, yam, litestream, spicedb, ctop, clusterctl, crane, aws-flb-firehose, neuvector-scanner, prometheus-redis-exporter, external-dns, crossplane-provider-aws, grafana-mimir, prometheus-postgres-exporter, argo-workflows,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: minio, aws-ebs-csi-driver, flux-helm-controller, ip-masq-agent, kubernetes-dashboard, prometheus-pushgateway, kubebuilder, argo-cd, dataplaneapi, yam, rqlite, tailscale, petname, temporal-server, ctop, clusterctl, cri-tools, kor, aws-flb-firehose,...

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration

A new Rust-based information stealer malware called Fickle Stealer has been observed being delivered via multiple attack chains with the goal of harvesting sensitive information from compromised hosts. Fortinet FortiGuard Labs said it's aware of four different distribution methods -- namely VBA...

Experts Uncover New Evasive SquidLoader Malware Targeting Chinese Organizations

Cybersecurity researchers have uncovered a new evasive malware loader named SquidLoader that spreads via phishing campaigns targeting Chinese organizations. AT&T LevelBlue Labs, which first observed the malware in late April 2024, said it incorporates features that are designed to thwart static...

HUMINT in a cyber world

TL;DR HUMINT / Human Intelligence is gathered from a person in the location in question. It’s the sort of information we think of in the context of spying. A modern intelligence apparatus is multi-discipline with many different collection methods. HUMINT sources include officers, agents,...

CVE-2024-4390

The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with contributor access and above, to generate a valid nonce for any WordPress...

CVE-2024-4390

The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with contributor access and above, to generate a valid nonce for any WordPress...

CVE-2024-4390 Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation

The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with contributor access and above, to generate a valid nonce for any WordPress...

CVE-2023-3204

The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with.....

CVE-2023-3204

The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with.....

CVE-2023-3204 Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update

The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with.....

CVE-2024-3627 Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints

The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible...

SUSE: Security Advisory (SUSE-SU-2024:2090-1)

The remote host is missing an update for...

CVE-2024-36680

In the module "Facebook" (pkfacebook) &lt;=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL...

CVE-2024-36680

In the module "Facebook" (pkfacebook) &lt;=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL...

New Blog Moderation Policy

There has been a lot of toxicity in the comments section of this blog. Recently, we're having to delete more and more comments. Not just spam and off-topic comments, but also sniping and personal attacks. It's gotten so bad that I need to do something. My options are limited because I'm just one...

Security Bulletin: Vulnerabilities in JAR files affect Transparent Cloud Tiering in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in multiple JAR files affect Transparent Cloud Tiering in IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products. The vulnerabilities are not thought to be exploitable but IBM recommends upgrade for users of Transparent Cloud Tiering...

Kraken Crypto Exchange Hit by $3 Million Theft Exploiting Zero-Day Flaw

Crypto exchange Kraken revealed that an unnamed security researcher exploited an "extremely critical" zero-day flaw in its platform to steal $3 million in digital assets and refused to return them. Details of the incident were shared by Kraken's Chief Security Officer, Nick Percoco, on X (formerly....

CVE-2021-47608

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic fetch The change in commit 37086bfdc737 ("bpf: Propagate stack bounds to registers in atomics w/ BPF_FETCH") around check_mem_access() handling is buggy since this would allow for...

CVE-2021-47608

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic fetch The change in commit 37086bfdc737 ("bpf: Propagate stack bounds to registers in atomics w/ BPF_FETCH") around check_mem_access() handling is buggy since this would allow for...

CVE-2021-47608

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic fetch The change in commit 37086bfdc737 ("bpf: Propagate stack bounds to registers in atomics w/ BPF_FETCH") around check_mem_access() handling is buggy since this would allow for...

CVE-2021-47582

In the Linux kernel, the following vulnerability has been resolved: USB: core: Make do_proc_control() and do_proc_bulk() killable The USBDEVFS_CONTROL and USBDEVFS_BULK ioctls invoke usb_start_wait_urb(), which contains an uninterruptible wait with a user-specified timeout value. If timeout value.....