8009 matches found
CVE-2021-25032
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a...
Cross site request forgery (csrf)
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a...
CVE-2021-25032
The CVE concerns the WordPress plugins PublishPress Capabilities and PublishPress Capabilities Pro (versions before 2.3.1). The issue stems from missing authorization and CSRF checks when updating plugin settings via the init hook, and failure to validate that updated options belong to the plugin...
Microsoft Sees Rampant Log4j Exploit Attempts, Testing
No surprise here: The holidays bought no Log4Shell relief. Threat actors vigorously launched exploit attempts and testing during the last weeks of December, Microsoft said on Monday, in the latest update to its landing page and guidance around the flaws in Apache’s Log4j logging library. “We have...
WordPress TrustMate.io – integracja z WooCommerce plugin <= 1.7.0 - Arbitrary Blog Option Update vulnerability
Arbitrary Blog Option Update vulnerability discovered by WPScanTeam in WordPress TrustMate.io – integracja z WooCommerce plugin versions = 1.7.0. Solution Update the WordPress TrustMate.io – integracja z WooCommerce plugin to the latest available version at least 1.7.1...
Top 5 DevOps Resource Center Articles of 2021
We look back on the 5 most popular DevOps Resource Center articles in 2021 to help you build at your best in 2022...
Mitigating Log4Shell and Other Log4j-Related Vulnerabilities
Summary The Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, National Security Agency NSA, Australian Cyber Security Centre ACSC, Canadian Centre for Cyber Security CCCS, the Computer Emergency Response Team New Zealand CERT NZ, the New Zealand...
CVE-2020-20605
Blog CMS v1.0 contains a cross-site scripting XSS vulnerability in the /controller/CommentAdminController.java component...
CVE-2020-20605
Blog CMS v1.0 contains a cross-site scripting XSS vulnerability in the /controller/CommentAdminController.java component...
Cross site scripting
Blog CMS v1.0 contains a cross-site scripting XSS vulnerability in the /controller/CommentAdminController.java component...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Apache-Log4j-POC CVE-2021-44228 Proof of Concept of apache log...
CVE-2020-20605
Blog CMS v1.0 contains a cross-site scripting XSS vulnerability in the /controller/CommentAdminController.java component...
CVE-2020-20605
CVE-2020-20605 affects Blog CMS v1.0, with a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component. The vulnerability is corroborated across multiple sources (NVD/NVD-derived and related feeds) and targets a PHP/MySQL BlogCMS; key impact details indicat...
Shortcode Addons < 3.1.0 - Unauthenticated Arbitrary Option Update
The plugin does not have any authorisation in its REST API endpoint, one of them could allow unauthenticated attackers to update arbitrary blog options. PoC POST /wp-json/ShortCodeAddonsUltimate/v2/addonssettings HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate...
Tabs < 3.6.0 - Unauthenticated Arbitrary Option Update
The plugin does not have any authorisation in its REST API endpoint, one of them could allow unauthenticated attackers to update arbitrary blog options. PoC...
Threat Source Newsletter (Dec. 16, 2021)
Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. I'm just going to cut to the chase since I know all anyone wants to read about is Log4J. For the latest Talos research, continually check back on our blog post here. Above is the live stream we recorded Monday morning... This is on...
Apache Log4j Remote Code Execution Vulnerability
Certain versions of Apache Log4j2 are vulnerable to a remote code execution vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Microsoft is not aware of any impact to th...
Google Warns That NSO Hacking Is On Par With Elite Spy Groups
ForcedEntry is “one of the most technically sophisticated exploits” Project Zero security researchers have ever seen...
Beers with Talos, Ep. #112: A new host approaches!
Beers with Talos BWT Podcast episode No. 112 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherIf iTunes and Google Play aren't your thing, click here. We promised it wouldn't be long... This is only the beginning! Please vis...
CVE-2021-43890
creationtimestamp| type| source ---|---|--- 2021-12-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=704 2021-12-15 17:34:38+00:00| seen| https://t.me/truesecator/2447 2021-12-15 18:20:35+00:00| seen| https://t.me/cibsecurity/34035 2022-02-06 21:38:36+00:00| exploited|...