Stop Spam Comments <= 0.2.1.2 - Access Token Bypass

The plugin does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. PoC Collect the name and value of ssckey for the target post and use it on the request. curl...

Researchers Detail Techniques LockBit Ransomware Using to Infect its Targets

LockBit ransomware attacks are constantly evolving by making use of a wide range of techniques to infect targets while also taking steps to disable endpoint security solutions. "The affiliates that use LockBit's services conduct their attacks according to their preference and use different tools...

Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure

The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication PoC https://example.com/wp-json/wp/v2/coauthors...

Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure

The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication https://example.com/wp-json/wp/v2/coauthors...

WordPress Co-Authors Plus plugin <= 3.5.1 - Guest Authors Email Address Disclosure vulnerability

Guest Authors Email Address Disclosure vulnerability discovered by Douglas Johnson in WordPress Co-Authors Plus plugin versions = 3.5.1. Solution Update the WordPress Co-Authors Plus plugin to the latest available version at least 3.5.2...

CVE-2022-29221 PHP Code Injection by malicious block or filename in Smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious block name or include file name. Sites that cannot fully trust template authors shou...

HaccTheHub - Open Source Self-Hosted Cyber Security Learning Platform

Open source self-hosted cyber security learning platform About The Project HaccTheHub is an open source project that provides cyber security The HaccTheHub system consists of 3 main parts: Docker: containing all of the boxes creating the environment in which we'll be learning on. The backend:...

WordPress BookPress – For Book Authors plugin < 1.2.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress BookPress – For Book Authors plugin versions 1.2.3. Solution Update the WordPress BookPress – For Book Authors plugin to the latest available version at least 1.2.3...

WordPress BookPress – For Book Authors plugin < 1.2.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress BookPress – For Book Authors plugin versions 1.2.3. Solution Update the WordPress BookPress – For Book Authors plugin to the latest available version at least 1.2.3...

Cybercriminals hit malware authors with malicious NPM packages

By Deeba Ahmed Discord tokens have become the perfect medium for cybercriminals to gain unauthorized access to accounts allowing the operators… This is a post from HackRead.com Read the original post: Cybercriminals hit malware authors with malicious NPM packages...

Exploit for Missing Authentication for Critical Function in Apache Apisix_Dashboard

CVE-2021-45232 RCE POC Screenshots !P...

Certify - Active Directory Certificate Abuse

Certify is a C tool to enumerate and abuse misconfigurations in Active Directory Certificate Services AD CS. @harmj0y and @tifkin are the primary authors of Certify and the the associated AD CS research blog and whitepaper. Usage C:\ToolsCertify.exe / | | | / | | | | | | | | | / \ '| | | | | | | ...

Segmentation fault in time

Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library. The...

GitLab 输入验证错误漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug list, and more. An input validation error vulnerability exists in GitLab...

Is crypto’s criminal rollercoaster approaching a terminal dip?

It’s a turbulent time in the cryptomining realm, especially for malware authors. Some big attacks and a lot of publicity has resulted in prolific groups promising to disband, even if potentially only temporarily. Running a tighter ship The mining banhammer continues to swing as China keeps puttin...

Microsoft Visual Studio Code 权限许可和访问控制问题漏洞

Microsoft Visual Studio Code is an open source code editor from Microsoft Corporation USA. A vulnerability exists in Microsoft Visual Studio Code due to privilege licensing and access control issues. The following products and versions are affected: .NET Education Bundle SDK Install Tool, .NET...

Security Update for Microsoft Visual Studio Code .NET Install Tool for Extension Authors Extension (July 2021)

The Microsoft Visual Studio Code .NET Install Tool for Extension Authors Extension is prior to version 1.2.0. It is, therefore, affected by an elevation of privilege vulnerability due to inaccurately scoped permissions being set on downloaded .NET install scripts. Note that Nessus has not tested...

Babuk Ransomware Builder Mysteriously Appears in VirusTotal

The Babuk ransomware gang’s source code has been uploaded to VirusTotal, making it available to all security vendors and competitors. It’s unclear however just how that happened. According to a Wednesday posting from Malwarebytes, the operators of the ransomware – perhaps best-known for hitting t...

Behind the scenes with the head of Kaspersky’s GReAT

Costin Raiu has been with Kaspersky since 2000, initially as the Chief Security Expert overseeing research efforts in the EEMEA region. In 2010, he became Director of our Global Research and Analysis Team GReAT. During his tenure at Kaspersky, he has spearheaded the companys research on some of t...

CVE-2021-24168

The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields such as Email Subject, Email Recipient, etc when creating or editing a form, leading to an authenticated author+ stored cross-site scripting issue. This could allow medium privilege accounts such a...