FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT

The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT. "The threat actors used malicious websites to impersonate well-known brands,...

NSA, FBI Alert on N. Korean Hackers Spoofing Emails from Trusted Sources

The U.S. government on Thursday published a new cybersecurity advisory warning of North Korean threat actors' attempts to send emails in a manner that makes them appear like they are from legitimate and trusted parties. The joint bulletin was published by the National Security Agency NSA, the...

Deepfakes and AI-Driven Disinformation Threaten Polls

Cheap and easy access to AI makes it harder to detect state-sponsored and homegrown campaigns during this election year...

Okta Warns of Unprecedented Surge in Proxy-Driven Credential Stuffing Attacks

Identity and access management IAM services provider Okta has warned of a spike in the "frequency and scale" of credential stuffing attacks aimed at online services. These unprecedented attacks, observed over the last month, are said to be facilitated by "the broad availability of residential pro...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3059

The CVE CVE-2024-3059 affects the ENL Newsletter WordPress plugin (versions ≤ 1.0.1). It reports CSRF checks missing in certain areas, enabling CSRF attackers to make logged-in admins delete arbitrary campaigns. Public details in connected docs confirm impact and affected software but do not prov...

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

...

U.S. Treasury Sanctions Iranian Firms and Individuals Tied to Cyber Attacks

The U.S. Treasury Department's Office of Foreign Assets Control OFAC on Monday sanctioned two firms and four individuals for their involvement in malicious cyber activities on behalf of the Iranian Islamic Revolutionary Guard Corps Cyber Electronic Command IRGC-CEC from at least 2016 to April 202...

Zoho Campaigns < 2.0.8 - Cross-Site Request Forgery via zcwc_optin_save

Description The Zoho Campaigns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the zcwcoptinsave function. This makes it possible for unauthenticated attackers to update the optin...

Zoho Campaigns < 2.0.8 - Cross-Site Request Forgery via zcwc_integration_disconnect

Description The Zoho Campaigns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the zcwcintegrationdisconnect function. This makes it possible for unauthenticated attackers to disconne...

Zoho Campaigns < 2.0.7 - Authenticated (Contributor+) SQL Injection

Description The Zoho Campaigns plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

CVE-2024-32442

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

CVE-2024-32441

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

CVE-2024-32441

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

CVE-2024-32442

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

CVE-2024-32441 WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

CVE-2024-32441 WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7...

CVE-2024-32441

CVＥ-2024-32441 is a Cross-Site Request Forgery vulnerability in Zoho Campaigns, affecting Zoho Campaigns versions up to 2.0.7 (start version not specified). The root cause is CSRF in the workflow that could trigger unauthorized actions on behalf of an authenticated user. Connected documents reite...

CVE-2024-32442

Technical details about CVE-2024-32442 are not publicly provided in the supplied documents; no affected product versions, impact, or fixes are specified here. Monitor for updates.