2090 matches found
D3Fack Loader: New Malware Exploits Google Ads and EV Certificates
...
WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Broken Access Control
Software AdFoxly – Ad Manager, AdSense Ads & Ads.txt Type Plugin Vulnerable versions = 1.8.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34802 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ce75fd580f25 Credits...
CVE-2024-2290
The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placementslug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in t...
FIN7 Group Leverages Sponsored Ads to Disseminate Malicious Payloads
...
WordPress plugin Advanced Ads 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin Advanced Ads 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2024-3952: Improper Neutralization of Input During Web Page Generation
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-2290: Deserialization of Untrusted Data
The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placementslug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in t...
FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT
The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT. "The threat actors used malicious websites to impersonate well-known brands,...
CVE-2024-2290 Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object Injection
The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placementslug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in t...
CVE-2024-2290
CVE-2024-2290 : Advanced Ads – Ad Manager & AdSense for WordPress (up to 1.52.1) is vulnerable to PHP Object Injection via deserialization of untrusted input in the placement_slug parameter. The issue enables authenticated attackers to inject a PHP object. The Red Hat advisory and Wordfence note ...
PT-2024-28517 · WordPress · Advanced Ads
Name of the Vulnerable Software and Affected Versions: Advanced Ads – Ad Manager & AdSense plugin for WordPress versions up to and including 1.52.1 Description: The issue is related to Stored Cross-Site Scripting via the Advanced Ad widget due to insufficient input sanitization and output escapin...
WordPress Advanced Ads plugin <= 1.52.1 - Authenticated (Admin+) PHP Object Injection vulnerability
Authenticated Admin+ PHP Object Injection vulnerability discovered by ST in WordPress Plugin Advanced Ads versions = 1.52.1...
WordPress Advanced Ads plugin <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Ad Widget vulnerability discovered by wesley wcraft in WordPress Plugin Advanced Ads versions = 1.52.1...
Directorist < 7.9.0 - Missing Authorization
Description The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.8.6. This makes it possible for unauthenticated attacker...
CVE-2024-28725
Cross Site Scripting XSS vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings...
A week in security (April 29 – May 5)
Last week on Malwarebytes Labs: You get a passkey, you get a passkey, everyone should get a passkey Dropbox Sign customer data accessed in breach Watch out for tech support scams lurking in sponsored search results Psychotherapy practice hacker gets jail time after extorting patients, publishing...
CVE-2024-28725
Cross Site Scripting XSS vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings...
CVE-2024-28725: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings...
CVE-2024-28725
A Cross Site Scripting (XSS) vulnerability exists in YzmCMS version 7.0 . The flaw allows attackers to execute arbitrary code by targeting the Ads Management , Carousel Management , and System Settings components. While the vulnerability is classified as XSS, the documentation explicitly states i...