1747 matches found
A Single Iranian Hacker Group Targeted Both Presidential Campaigns, Google Says
APT42, which is believed to work for Iran’s Revolutionary Guard Corps, targeted about a dozen people associated with both Trump’s and Biden’s campaigns this spring, according to Google’s Threat Analysis Group...
CVE-2024-38752
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Zoho Campaigns allows Cross-Site Scripting XSS.This issue affects Zoho Campaigns: from n/a through 2.0.8...
CVE-2024-38752 WordPress Zoho Campaigns plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Zoho Campaigns allows Cross-Site Scripting XSS.This issue affects Zoho Campaigns: from n/a through 2.0.8...
CVE-2024-38752 WordPress Zoho Campaigns plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Zoho Campaigns allows Cross-Site Scripting XSS.This issue affects Zoho Campaigns: from n/a through 2.0.8...
CVE-2024-38752
The CVE CVE-2024-38752 affects Zoho Campaigns WordPress plugin versions up to and including 2.0.8, with an XSS vulnerability caused by improper input neutralization during web page generation. The issue allows cross-site scripting in affected pages and has CVSS 3.1 base metrics (Network attack; l...
WordPress plugin Zoho Campaigns 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Cybercriminals Target Polish Businesses with Agent Tesla and Formbook Malware
Cybersecurity researchers have detailed widespread phishing campaigns targeting small and medium-sized businesses SMBs in Poland during May 2024 that led to the deployment of several malware families like Agent Tesla, Formbook, and Remcos RAT. Some of the other regions targeted by the campaigns...
VMware ESXi CVE-2024-37085 Targeted in Ransomware Campaigns
On Monday, July 29, Microsoft published an extensive threat intelligence blog on observed exploitation of CVE-2024-37085, an Active Directory integration authentication bypass vulnerability affecting Broadcom VMware ESXi hypervisors. The vulnerability, according to Redmond, was identified in...
Gh0st RAT Trojan Targets Chinese Windows Users via Fake Chrome Site
The remote access trojan known as Gh0st RAT has been observed being delivered by an "evasive dropper" called Gh0stGambit as part of a drive-by download scheme targeting Chinese-speaking Windows users. These infections stem from a fake website "chrome-web.com" serving malicious installer packages...
Paris Olympics 2024: Securing The Games
The Rising Cyber Threats In recent years, the threat of cyberattacks has grown exponentially, affecting the sports sector as well. Major international events like the Olympics are prime targets for cybercriminals, hacktivists, and even nation-states. The reasons are clear: these events attract...
A week in security (July 8 – July 14)
Last week on Malwarebytes Labs: "Nearly all" AT&T customers had phone records stolen in new data breach disclosure Fake Microsoft Teams for Mac delivers Atomic Stealer Dangerous monitoring tool mSpy suffers data breach, exposes customer details iPhone users in 98 countries warned about spyware by...
WordPress Zoho Campaigns plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Zoho Campaigns versions = 2.0.8...
New Poco RAT Targets Spanish-Speaking Victims in Phishing Campaign
Spanish language victims are the target of an email phishing campaign that delivers a new remote access trojan RAT called Poco RAT since at least February 2024. The attacks primarily single out mining, manufacturing, hospitality, and utilities sectors, according to cybersecurity company Cofense...
When spear phishing met mass phishing
Introduction Bulk phishing email campaigns tend to target large audiences. They use catch-all wordings and simplistic formatting, and typos are not uncommon. Targeted attacks take greater effort, with attackers sending personalized messages that include personal details and might look more like...
Impact of data breaches is fueling scam campaigns
Data breaches have become one of the most crucial threats to organizations across the globe, and theyve only become more prevalent and serious over time. A data breach occurs when unauthorized individuals gain access to sensitive, protected or confidential data. This stolen data can include...
WordPress Zoho Campaigns Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)
Software Zoho Campaigns Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.1.0 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-38752 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 48112379bb70 Credits Majed Refaea Required...
ViperSoftX Malware Disguises as eBooks on Torrents to Spread Stealthy Attacks
The sophisticated malware known as ViperSoftX has been observed being distributed as eBooks over torrents. "A notable aspect of the current variant of ViperSoftX is that it uses the Common Language Runtime CLR to dynamically load and run PowerShell commands, thereby creating a PowerShell...
Experts Warn of Mekotio Banking Trojan Targeting Latin American Countries
Financial institutions in Latin America are being threatened by a banking trojan called Mekotio aka Melcoz. That's according to findings from Trend Micro, which said it recently observed a surge in cyber attacks distributing the Windows malware. Mekotio, known to be actively put to use since 2015...
CVE-2024-37476
Cross Site Scripting XSS vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack Campaigns: from n/a through 2.31.1...
CVE-2024-37476
CVE-2024-37476 is a Stored XSS affecting Automattic Newspack Campaigns (WordPress plugin) up to version 2.31.1. The vulnerability is confirmed in WordPress ecosystem sources; remediation is to upgrade Newspack Campaigns to a version where the fix is in place (patched). No exploitation activity is...