PT-2024-14003 · WordPress · Melapress Wp Activity Log

Name of the Vulnerable Software and Affected Versions: Melapress WP Activity Log versions through 4.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

CVE-2024-25841

creationtimestamp| type| source ---|---|--- 2024-02-27 18:31:37+00:00| seen| https://t.me/ctinow/194714 2024-02-27 18:36:59+00:00| seen| https://t.me/ctinow/194729 2024-03-14 18:26:46+00:00| seen| https://t.me/ctinow/208015...

CVE-2024-1920

creationtimestamp| type| source ---|---|--- 2024-02-27 15:31:48+00:00| seen| https://t.me/ctinow/194495 2024-02-27 15:36:30+00:00| seen| https://t.me/ctinow/194506 2024-03-14 14:26:26+00:00| seen| https://t.me/ctinow/207752...

8,000+ Domains of Trusted Brands Hijacked for Massive Spam Operation

More than 8,000 domains and 13,000 subdomains belonging to legitimate brands and institutions have been hijacked as part of a sophisticated distribution architecture for spam proliferation and click monetization. Guardio Labs is tracking the coordinated malicious activity, which has been ongoing...

CVE-2014-2902

creationtimestamp| type| source ---|---|--- 2024-02-26 09:12:05+00:00| seen| https://t.me/ctinow/193176...

WP Activity Log < 4.6.2 - Unauthenticated Stored Cross-Site Scripting

Description The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

MAL-2024-1037 Malicious code in virtuoso-ui-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e312940c270bdfe72147c1582e1a07fef45096820038e878c4f91bdd444c03dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-1362

creationtimestamp| type| source ---|---|--- 2024-02-23 12:26:20+00:00| seen| https://t.me/ctinow/191678 2024-02-23 12:26:24+00:00| seen| https://t.me/ctinow/191682 2024-03-13 17:11:56+00:00| seen| https://t.me/ctinow/206916...

CVE-2024-21726

creationtimestamp| type| source ---|---|--- 2024-02-22 14:40:05+00:00| seen| https://t.me/truesecator/5448 2024-02-29 02:56:14+00:00| seen| https://t.me/ctinow/196104 2024-02-29 03:02:47+00:00| seen| https://t.me/ctinow/196121 2026-07-06 11:00:12+00:00| seen| https://t.me/ZerodayAlert/177...

Malicious code in fekirinetest3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d30cf456a09063b4672e17f53005e2923a34352b7e88c52f104a389cadca5c0d The OpenSSF Package Analysis project identified 'fekirinetest3' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-25602

creationtimestamp| type| source ---|---|--- 2024-02-21 03:31:50+00:00| seen| https://t.me/ctinow/189152 2024-02-22 03:59:20+00:00| seen| https://t.me/arpsyndicate/3908...

ThreatDown EDR update: Streamlined Suspicious Activity investigation

Navigating the complex world of alerts just got easier, thanks to our latest enhancements to the ThreatDown Endpoint Detection and Response EDR platform. The detailed technical information in EDR alerts—replete with complicated diagrams and references to advanced cybersecurity tactics—can overwhe...

CVE-2024-25260

creationtimestamp| type| source ---|---|--- 2024-02-20 19:27:24+00:00| seen| https://t.me/ctinow/188851 2024-02-20 19:32:14+00:00| seen| https://t.me/ctinow/188867 2024-02-20 22:46:16+00:00| seen| https://t.me/ctinow/188969 2024-02-21 15:32:05+00:00| seen| https://t.me/arpsyndicate/3847...

CVE-2023-52434

creationtimestamp| type| source ---|---|--- 2024-02-20 19:27:12+00:00| seen| https://t.me/ctinow/188842 2024-02-20 19:31:54+00:00| seen| https://t.me/ctinow/188858 2024-02-21 10:51:52+00:00| seen| https://t.me/ctinow/189453...

CVE-2023-22098

creationtimestamp| type| source ---|---|--- 2024-02-20 14:26:23+00:00| seen| https://t.me/proxybar/1913 2024-02-20 16:20:27+00:00| published-proof-of-concept| https://t.me/cybersecs/2737 2024-03-04 10:58:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10085 2024-03-27...

PT-2024-21290 · Element · Element Android

Name of the Vulnerable Software and Affected Versions: Element Android versions 1.4.3 through 1.6.10 Description: The issue allows a third-party malicious application to start any internal activity by passing some extra parameters, potentially making Element Android display an arbitrary web page,...

CVE-2024-25636

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

Design/Logic Flaw

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

CVE-2024-25636 Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

CVE-2024-25981 Msa-24-0004: forum export did not respect activity group settings

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers...