WordPress Accessibility Widget Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software Accessibility Widget Type Plugin Vulnerable versions = 2.2 Fixed in 2.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32831 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b4d9bba529ce Credits Joshua Chan Required privileg...

CVE-2024-26918 PCI: Fix active state requirement in PME polling

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus requirement that runtime PM managed devices need to be in the RPMACTIVE state for PME polling. In fact, only devices in low power states...

WP Accessibility Helper (WAH) < 0.6.2.6 - Missing Authorization

Description The WP Accessibility Helper WAH plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateattachmentalt function in versions up to, and including, 0.6.2.5. This makes it possible for authenticated attackers, with...

Best Practices for Optimizing Web Development Standards for Media Sites

By Owais Sultan Boost user engagement and SEO ranking with these key web development practices for media sites. Discover responsive design, page speed optimization, user-friendly CMS, SEO structure, and accessibility best practices. This is a post from HackRead.com Read the original post: Best...

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WP Accessibility Helper WAH versions = 0.6.2.5...

The vulnerability of the decode_uncompressed_image() function, a decoder and file format encoder for the libheif library, allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the decodeuncompressedimage function, a decoder and file format encoder for the libheif library, is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the /libheif/exif.cc decoder and encoder for libheif files allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /libheif/exif.cc decoder and file format encoder in the libheif library is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability in the accessibility components of iOS and iPadOS operating systems allows attackers to gain access to the user’s location.

The vulnerability of the Accessibility component in iOS and iPadOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain access to the user’s location...

The vulnerability of the programmatic tools and libraries used for working with OpenSC smart cards stems from improper restrictions on operations within memory buffers. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the programmatic tools and libraries used to work with OpenSC smart cards is related to memory errors during card registration using the pkcs15-init function. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility o...

The software for simulation and automation of discrete events in Arena Simulation is vulnerable due to an operation that goes beyond the buffer in memory, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Arena Simulation software for modeling and automating discrete events arises from the execution of an operation outside the buffer in memory. Exploiting this vulnerability can allow a hacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Arena Simulation software for modeling and automating discrete events lies in the use of an uninitialized pointer on the stack, which allows a hacker to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Arena Simulation software for modeling and automating discrete events is related to the use of an uninitialized pointer on the stack. Exploiting this vulnerability allows a attacker to execute arbitrary code and compromise the confidentiality, integrity, and accessibility...

CVE-2024-3138

The CVE-2024-3138 entry concerns francoisjacquet RosarioSIS 11.5.1, where a Cross-Site Scripting (XSS) vulnerability is attributed to an unknown processing in the Add Portal Note component. Reported impact is remote exploitation with user interaction required, leading to I(low) and A(none) for co...

Vultur Android Banking Trojan Returns with Upgraded Remote Control Capabilities

The Android banking trojan known as Vultur has resurfaced with a suite of new features and improved anti-analysis and detection evasion techniques, enabling its operators to remotely interact with a mobile device and harvest sensitive data. "Vultur has also started masquerading more of its...

Malicious code in amcharts-accessibility-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3d8c46b66a30d5f77349bdbe5c55b3412346a1b9ee26009a3ee535cdcf1e1677 The OpenSSF Package Analysis project identified 'amcharts-accessibility-plugin' @ 99.3.0 npm as malicious. It is considered malicious because: -...

Powering the future of ThreatDown with AI

Nobody can deny the influence of AI today. In just a few years, we have observed AIs capacity to be as transformative as the internet and smartphones, especially for cybersecurity. Indeed, the potential of AI to radically simplify complex security environments is unmistakable, and aligns closely...

The vulnerability of the fromDhcpListClient() function (/goform/DhcpListClient) in the Tenda AC15 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromDhcpListClient function /goform/DhcpListClient in the Tenda AC15 router’s software is related to the operation of writing data beyond the buffer in memory when processing the page parameter. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the addWifiMacFilter function (/goform/addWifiMacFilter) in the Tenda AC10U router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the addWifiMacFilter function /goform/addWifiMacFilter in the Tenda AC10U router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2023-32359

A flaw was found in webkitgtk where a user’s password may be read aloud by a text-to-speech accessibility feature...

PixPirate Android Banking Trojan Using New Evasion Tactic to Target Brazilian Users

The threat actors behind the PixPirate Android banking trojan are leveraging a new trick to evade detection on compromised devices and harvest sensitive information from users in Brazil. The approach allows it to hide the malicious app's icon from the home screen of the victim's device, IBM said ...

ROS-2-933

2.933 Mozilla Firefox browser vulnerability CVE-2021-29970, CVE-2021-29976 1. Vulnerability description: CVE-2021-29970 A vulnerability in the Mozilla Firefox browser, is related to a release error in accessibility functions when processing HTML content. Exploitation of the vulnerability could...