CVE-2024-12026: Missing Authorization

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilter function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-12027

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter and deleteFilter functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with...

CVE-2024-12027 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter and deleteFilter functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with...

CVE-2024-12027 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter and deleteFilter functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with...

PT-2024-17408

Name of the Vulnerable Software and Affected Versions The Message Filter for Contact Form 7 plugin for WordPress versions up to, and including, 1.6.3 Description The issue is related to unauthorized modification of data due to a missing capability check on the updateFilter and deleteFilter...

CVE-2024-12027: Missing Authorization

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter and deleteFilter functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with...

WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Message Filter for Contact Form 7 versions = 1.6.3...

RHEL 7 : gimp:2.8.22 (RHSA-2024:10666)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10666 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

Oracle Linux 7 : krb5 (ELSA-2024-8788)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8788 advisory. 1.15.1-55.0.7 - libkrad: implement support for Message-Authenticator CVE-2024-3596 Orabug: 37241077 Tenable has extracted the preceding description block direct...

CVE-2024-49360

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user UserA with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders C:\Sandbox\UserB\xxx. An authenticated attack...

CVE-2024-49360

Sandboxie path traversal vulnerability (CVE-2024-49360) allows an authenticated, non-privileged user to read files created in other users’ sandboxes (C:\Sandbox\UserX\xxx). The root cause is failure to reset ACLs when a folder with malicious ACLs is created (e.g., C:\Sandbox\UserA), enabling acce...

Oracle Linux 7 : java-11-openjdk (ELSA-2024-8120)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8120 advisory. - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - 1001-orabug36904359-CVE-2024-21138-fix.patch -...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2024-8116)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8116 advisory. - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - 1001-orabug36904359-CVE-2024-21131-fix.patch -...

GO-2024-3290 Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium

Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium...

BIT-HUBBLE-RELAY-2024-52529 Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range AND 2. A Layer 7 allow policy that selects a specific port within the first policy's range...

BIT-CILIUM-OPERATOR-2024-52529 Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range AND 2. A Layer 7 allow policy that selects a specific port within the first policy's range...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 (RHSA-2024:10208)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10208 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

7-Zip Qcow Handler Infinite Loop DoS Vulnerability - Windows

7zip is prone to a qcow handler infinite loop denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

7-Zip Zstandard Decompression Integer Underflow Vulnerability - Windows

7zip is prone to a zstandard decompression integer underflow vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Analysis of Elpaco: a Mimic variant

Introduction In a recent incident response case, we dealt with a variant of the Mimic ransomware with some interesting customization features. The attackers were able to connect via RDP to the victim's server after a successful brute force attack and then launch the ransomware. After that, the...