WordPress Local Delivery Drivers for WooCommerce plugin <= 1.8.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Local Delivery Drivers for WooCommerce plugin versions = 1.8.4. Solution Update the WordPress Local Delivery Drivers for WooCommerce plugin to the latest available version at least 1.8.5...

WordPress Delivery Drivers for Vendors plugin <= 1.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Delivery Drivers for Vendors plugin versions = 1.0.8. Solution Update the WordPress Delivery Drivers for Vendors plugin to the latest available version at least 1.0.9...

WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin versions = 1.0.1. Solution Update the WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin to the latest available...

WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.3.14 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Food Store – Online Food Delivery & Pickup plugin versions = 1.3.14. Solution Update the WordPress Food Store – Online Food Delivery & Pickup plugin to the latest available version at least 1.4...

WordPress Delivery Drivers Manager plugin <= 1.1.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Delivery Drivers Manager plugin versions = 1.1.5. Solution Update the WordPress Delivery Drivers Manager plugin to the latest available version at least 1.1.6...

WordPress Delivery Drivers for Vendors plugin <= 1.0.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Delivery Drivers for Vendors plugin versions = 1.0.8. Solution Update the WordPress Delivery Drivers for Vendors plugin to the latest available version at least 1.0.9...

VDAs are still trying to register with old DDCs post changing the list of DDCs

Post changing the Delivery Controllers list, VDAs are still trying to register with the old Controllers. Deletes the old Delivery Controllers FQDN on "ListOfDDCs" key in "HKLM\Software\Citrix\VirtualDesktopAgent\Policy" registry and restarts the Citrix desktop service, however the VDAs are still...

WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin versions = 1.0.1. Solution Update the WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin to the latest available version at least 1.0.2...

WordPress Local Delivery Drivers for WooCommerce plugin <= 1.8.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Local Delivery Drivers for WooCommerce plugin versions = 1.8.4. Solution Update the WordPress Local Delivery Drivers for WooCommerce plugin to the latest available version at least 1.8.5...

WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.3.14 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Food Store – Online Food Delivery & Pickup plugin versions = 1.3.14. Solution Update the WordPress Food Store – Online Food Delivery & Pickup plugin to the latest available version at least 1.4...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0 <=2.2), org.jenkins-ci.plugins:token-macro (=2.2) +1 more potentially affected by CVE-2022-25184 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0 <=2.1)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =2.0, =1.0.0, =1.0.8 Source cves: CVE-2022-25184 Source advisory: OSV:GHSA-G84F-CMC8-682C...

Security Bulletin: IBM Cloud Private is vulnerable to FasterXML jackson-databind vulnerabilities (CVE-2020-24750)

Summary IBM Cloud Private is vulnerable to FasterXML jackson-databind vulnerabilities Vulnerability Details CVEID: CVE-2020-24750 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization between gadgets and...

Palestine-Aligned Hackers Use New NimbleMamba Implant in Recent Attacks

An advanced persistent threat APT hacking group operating with motives that likely align with Palestine has embarked on a new campaign that takes advantage of a previously undocumented implant called NimbleMamba. The intrusions leveraged a sophisticated attack chain targeting Middle Eastern...

Medusa Android Banking Trojan Spreading Through Flubot's Attacks Network

Two different Android banking Trojans, FluBot and Medusa, are relying on the same delivery vehicle as part of a simultaneous attack campaign, according to new research published by ThreatFabric. The ongoing side-by-side infections, facilitated through the same smishing SMS phishing infrastructure...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

Argo CD Security Bug Opens Kubernetes Cloud Apps to Attackers

A high-severity security vulnerability in Argo CD can enable attackers to access targets’ application-development environments, paving the way for stealing passwords, API keys, tokens and other sensitive information. Argo CD is a continuous-delivery platform deployed as a Kubernetes controller in...

KP Snacks Left with Crumbs After Ransomware Attack

KP Snacks, maker of the high-end Tyrrell’s and Popchips potato-chip brands, has suffered a ransomware attack that it said could affect deliveries to supermarkets through the end of March – at the earliest. The British company also the purveyor of deeply English treats such as Skips prawn cocktail...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Private (CVE-2021-45105)

Summary There is a vulnerability in the Apache Log4j open source library. The library is used by Elasticsearch, a dependency of IBM Cloud Private, for logging messages to files. This bulletin identifies the security fixes to apply to address the Log4Shell vulnerability CVE-2021-45105. Vulnerabili...

VulnCheck KEV: CVE-2017-8295

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

MoleRats APT Launches Spy Campaign on Bankers, Politicians, Journalists

Malicious files doctored up to look like legitimate content related to the Israeli-Palestine conflict are being used to target prominent Palestinians, as well as activists and journalists in Turkey, with spyware. That’s according to a disclosure from Zscaler, which attributes the cyberattacks to...