1737 matches found
PT-2023-10158 · Unknown · Media Downloader Plugin
Name of the Vulnerable Software and Affected Versions: Media Downloader Plugin version 0.1.992 Description: A vulnerability was found in the Media Downloader Plugin, affecting the dl file resumable function of the getfile.php file. The manipulation of the file argument leads to cross-site...
PureCrypter Malware Targets Government Entities in Asia-Pacific and North America
Government entities in Asia-Pacific and North America are being targeted by an unknown threat actor with an off-the-shelf malware downloader known as PureCrypter to deliver an array of information stealers and ransomware. "The PureCrypter campaign uses the domain of a compromised non-profit...
Python Developers Warned of Trojanized PyPI Packages Mimicking Popular Libraries
Cybersecurity researchers are warning of "imposter packages" mimicking popular libraries available on the Python Package Index PyPI repository. The 41 malicious PyPI packages have been found to pose as typosquatted variants of legitimate modules such as HTTP, AIOHTTP, requests, urllib, and urllib...
CVE-2022-4764
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...
CVE-2022-4764 Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via Shortcode
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...
CVE-2022-4764
The CVE-2022-4764 entry concerns the WordPress plugin Simple File Downloader (versions
CVE-2022-4764: Undefined Security Weakness
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...
WordPress Plugin Simple File Downloader 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-15448
Name of the Vulnerable Software and Affected Versions The Simple File Downloader WordPress plugin versions 1.0.0 through 1.0.4 Description The issue concerns the lack of validation and escaping of certain shortcode attributes in the plugin, which can lead to Stored Cross-Site Scripting attacks...
SUSE CVE-2009-1391
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...
The vulnerability of the Google Chrome web browser’s downloader, related to insufficient validation of input data, allows a hacker to gain access to confidential information.
The vulnerability of the Google Chrome web browser loader is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential information through a specially created HTML page...
CVE-2023-23333
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php...
Contec SolarView Compact 命令注入漏洞
Contec SolarView Compact is an application system from Contec Japan. It provides photovoltaic power generation measurement system. A security vulnerability exists in Contec SolarView Compact version 6.00 and earlier versions. An attacker can exploit the vulnerability to execute commands via...
Gootkit Malware Continues to Evolve with New Components and Obfuscations
The threat actors associated with the Gootkit malware have made "notable changes" to their toolset, adding new components and obfuscations to their infection chains. Google-owned Mandiant is monitoring the activity cluster under the moniker UNC2565 , noting that the usage of the malware is...
Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a Contributor+ create a new post and...
Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks As a Contributor+ create a new post and add...
GuLoader: The NSIS Vantage Point
GuLoader: The NSIS Vantage Point By Nico Paulo Yturriaga · January 24, 2023 GuLoader is an advanced shellcode downloader infamous for using anti-analysis tricks to evade detection and obstruct reverse engineering. As of this writing, the GuLoader campaign is aggressively ongoing. Trellix’s...
GuLoader: The NSIS Vantage Point
GuLoader: The NSIS Vantage Point By Nico Paulo Yturriaga · January 24, 2023 GuLoader is an advanced shellcode downloader infamous for using anti-analysis tricks to evade detection and obstruct reverse engineering. As of this writing, the GuLoader campaign is aggressively ongoing. Trellix’s...
Threat Round up for January 6 to January 13
Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Jan. 6 and Jan. 13. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...