WordPress Google Sheet Connector for Easy Digital Downloads plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Google Sheet Connector for Easy Digital Downloads plugin versions = 1.2. Solution Update the WordPress Google Sheet Connector for Easy Digital Downloads plugin to the latest available version at least...

Xenomorph banking Trojan downloaded over 50,000 times from Play Store

Besides the name of the creature that “stars” in the Alien movies by 20th Century Fox, Xenomorph is also the name given to an Android banking Trojan. Researchers found this banking Trojan to be distributed on the official Google Play Store, with more than 50,000 installations. The researchers...

CVE-2021-24867 Backdoored Plugins & Themes from AccessPress Themes

Numerous Plugins and Themes from the AccessPress Themes aka Access Keys vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to...

GHSA-W9MP-P2WP-2XF7 Improper file downloads in Apache Tapestry

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

Improper file downloads in Apache Tapestry

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

New Variant of UpdateAgent Malware Infects Mac Computers with Adware

Microsoft on Wednesday shed light on a previously undocumented Mac trojan that it said has undergone several iterations since its first appearance in September 2020, effectively granting it an "increasing progression of sophisticated capabilities." The company's Microsoft 365 Defender Threat...

The evolution of a Mac trojan: UpdateAgent’s progression

Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family—and depicts the rising complexity of threats across platforms. The trojan, tracked as UpdateAgent, started as a relatively basic information-stealer but was observed distributing...

The evolution of a Mac trojan: UpdateAgent’s progression

Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family—and depicts the rising complexity of threats across platforms. The trojan, tracked as UpdateAgent, started as a relatively basic information-stealer but was observed distributing...

Security Bulletin: NVIDIA GPU Display Driver - February 2022

NVIDIA has released a software security update for NVIDIA GPU Display Driver. This update addresses issues that may lead to denial of service or memory corruption. To protect your system, download and install this software update through the NVIDIA Driver Downloads page or, for the vGPU software...

GLSA-202201-02 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202201-02 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. Tenable has extracted the...

CVE-2021-40692

CVE-2021-40692 (Moodle) is described in connected sources as an insufficient capability check that allows teachers to download users outside of their courses. The OSV/NVD entries confirm the vulnerability is an access-control flaw enabling cross‑course user data access. Exploitation details or pa...

CVE-2021-40692

Insufficient capability checks made it possible for teachers to download users outside of their courses...

CVE-2022-22290

Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page...

Design/Logic Flaw

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

VulnCheck KEV: CVE-2017-11512

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

The vulnerability in the Google Updater application for browser-based downloads in Google Chrome and the Windows operating system arises from insecure privilege management. This allows a malicious individual to escalate their privileges through a created file.

The vulnerability of the Google Updater application for browser-based downloads in Google Chrome and Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to elevate their privileges through a specially created file...

The Great Christmas Download

Video game downloads and console updates helped game industry traffic peak at 125% above average on Christmas day according to Akamai, which supports more than 225 game publishers globally...

CVE-2021-20153

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious...

CVE-2021-20153

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious...

The vulnerability of the Downloads function in Google Chrome’s web browser allows a hacker to execute arbitrary code.

The vulnerability of the Windows operating system and the Google Chrome browser is related to privilege management errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...