WP ADA Compliance Check Basic – Most Comprehensive Web Accessibility Solution for WordPress < 3.1.4 - Cross-Site Request Forgery

Description The WP ADA Compliance Check Basic – Most Comprehensive Web Accessibility Solution for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing or incorrect nonce validation on several functions. This...

New 'Brokewell' Android Malware Spread Through Fake Browser Updates

Fake browser updates are being used to push a previously undocumented Android malware called Brokewell. "Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware," Dutch security firm ThreatFabric said in an analysis...

The vulnerability of the fromRouteStatic function in the microprogramming software for Tenda F1202, FH1202, AC7, and PW201A routers allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromRouteStatic function in the microprogramming software for Tenda F1202, FH1202, AC7, and PW201A routers is related to buffer overflows in the stack when processing the page parameter. Exploiting this vulnerability can allow an attacker to compromise the confidentiality...

WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Accessibility Widget versions = 2.2...

The vulnerability of SAP Asset Accounting software for asset management and accounting involves incorrect restrictions on path names in the catalog, allowing attackers to manipulate the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SAP Asset Accounting software for asset management and accounting is related to incorrect restrictions on the path to the catalog. Exploitation of this vulnerability can allow a malicious actor to influence the confidentiality, integrity, and accessibility of protected...

WordPress Accessibility Widget Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software Accessibility Widget Type Plugin Vulnerable versions = 2.2 Fixed in 2.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32831 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b4d9bba529ce Credits Joshua Chan Required privileg...

CVE-2024-26918 PCI: Fix active state requirement in PME polling

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus requirement that runtime PM managed devices need to be in the RPMACTIVE state for PME polling. In fact, only devices in low power states...

WP Accessibility Helper (WAH) < 0.6.2.6 - Missing Authorization

Description The WP Accessibility Helper WAH plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateattachmentalt function in versions up to, and including, 0.6.2.5. This makes it possible for authenticated attackers, with...

Best Practices for Optimizing Web Development Standards for Media Sites

By Owais Sultan Boost user engagement and SEO ranking with these key web development practices for media sites. Discover responsive design, page speed optimization, user-friendly CMS, SEO structure, and accessibility best practices. This is a post from HackRead.com Read the original post: Best...

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WP Accessibility Helper WAH versions = 0.6.2.5...

The vulnerability of the decode_uncompressed_image() function, a decoder and file format encoder for the libheif library, allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the decodeuncompressedimage function, a decoder and file format encoder for the libheif library, is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the /libheif/exif.cc decoder and encoder for libheif files allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /libheif/exif.cc decoder and file format encoder in the libheif library is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability in the accessibility components of iOS and iPadOS operating systems allows attackers to gain access to the user’s location.

The vulnerability of the Accessibility component in iOS and iPadOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain access to the user’s location...

The vulnerability of the programmatic tools and libraries used for working with OpenSC smart cards stems from improper restrictions on operations within memory buffers. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the programmatic tools and libraries used to work with OpenSC smart cards is related to memory errors during card registration using the pkcs15-init function. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility o...

The software for simulation and automation of discrete events in Arena Simulation is vulnerable due to an operation that goes beyond the buffer in memory, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Arena Simulation software for modeling and automating discrete events arises from the execution of an operation outside the buffer in memory. Exploiting this vulnerability can allow a hacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Arena Simulation software for modeling and automating discrete events lies in the use of an uninitialized pointer on the stack, which allows a hacker to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Arena Simulation software for modeling and automating discrete events is related to the use of an uninitialized pointer on the stack. Exploiting this vulnerability allows a attacker to execute arbitrary code and compromise the confidentiality, integrity, and accessibility...

CVE-2024-3138

The CVE-2024-3138 entry concerns francoisjacquet RosarioSIS 11.5.1, where a Cross-Site Scripting (XSS) vulnerability is attributed to an unknown processing in the Add Portal Note component. Reported impact is remote exploitation with user interaction required, leading to I(low) and A(none) for co...

Vultur Android Banking Trojan Returns with Upgraded Remote Control Capabilities

The Android banking trojan known as Vultur has resurfaced with a suite of new features and improved anti-analysis and detection evasion techniques, enabling its operators to remotely interact with a mobile device and harvest sensitive data. "Vultur has also started masquerading more of its...

Malicious code in amcharts-accessibility-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3d8c46b66a30d5f77349bdbe5c55b3412346a1b9ee26009a3ee535cdcf1e1677 The OpenSSF Package Analysis project identified 'amcharts-accessibility-plugin' @ 99.3.0 npm as malicious. It is considered malicious because: -...

Powering the future of ThreatDown with AI

Nobody can deny the influence of AI today. In just a few years, we have observed AIs capacity to be as transformative as the internet and smartphones, especially for cybersecurity. Indeed, the potential of AI to radically simplify complex security environments is unmistakable, and aligns closely...