CVE-2023-28705 Openfind Mail2000 - XSS (Reflected Cross-site scripting)

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it...

Unmasking XE Group: Experts Reveal Identity of Suspected Cybercrime Kingpin

Cybersecurity researchers have unmasked the identity of one of the individuals who is believed to be associated with the e-crime actor known as XE Group. According to Menlo Security, which pieced together the information from different online sources, "Nguyen Huu Tai, who also goes by the names J...

New Horabot campaign targets the Americas

Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling "Horabot," which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020. The threat actor appears to be targetin...

Actors, Threats and Vulnerabilities 22 to 28 May 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of ten attacks executed, taking advantage of four different vulnerabilities in vario...

CVE-2023-33316

Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...

CVE-2023-33319

CVE-2023-33319: Unauth. Reflected Cross-Site Scripting in the WooCommerce Follow-Up Emails (AutomateWoo) plugin, affecting versions up to and including 4.9.40. The vulnerability is an unauthenticated XSS that can be triggered via user-controlled input reflected in the response. Patchstack lists a...

CVE-2023-33316 WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...

CVE-2023-33316

CVE-2023-33316 is a CSRF vulnerability in the WooCommerce Follow-Up Emails (AutomateWoo) WordPress plugin, affecting versions

CVE-2023-33316 WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...

PT-2023-24290 · WordPress · Woocommerce Follow-Up Emails

Name of the Vulnerable Software and Affected Versions: WooCommerce Follow-Up Emails AutomateWoo plugin versions prior to 4.9.41 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts...

CVE-2023-33319: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...

CVE-2023-33316: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...

WordPress plugin WooCommerce Follow-Up Emails 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Stealing From Wallets to Browsers: Bandit Stealer Hits Windows Devices

By Deeba Ahmed Watch out for the Bandit Stealer malware that is being distributed through phishing emails. This is a post from HackRead.com Read the original post: Stealing From Wallets to Browsers: Bandit Stealer Hits Windows Devices...

New Stealthy Bandit Stealer Targeting Web Browsers and Cryptocurrency Wallets

A new stealthy information stealer malware called Bandit Stealer has caught the attention of cybersecurity researchers for its ability to target numerous web browsers and cryptocurrency wallets. "It has the potential to expand to other platforms as Bandit Stealer was developed using the Go...

WordPress plugin Customize WordPress Emails and Alerts – Better Notifications for WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Alert: Brazilian Hackers Targeting Users of Over 30 Portuguese Banks

A Brazilian threat actor is targeting more than 30 Portuguese financial institutions with information-stealing malware as part of a long-running campaign that commenced in 2021. "The attackers can steal credentials and exfiltrate users' data and personal information, which can be leveraged for...

Alert: Brazilian Hackers Targeting Users of Over 30 Portuguese Banks

A Brazilian threat actor is targeting more than 30 Portuguese financial institutions with information-stealing malware as part of a long-running campaign that commenced in 2021. "The attackers can steal credentials and exfiltrate users' data and personal information, which can be leveraged for...

Cyber Attacks Strike Ukraine's State Bodies in Espionage Operation

The Computer Emergency Response Team of Ukraine CERT-UA has warned of cyber attacks targeting state bodies in the country as part of an espionage campaign. The intrusion set, attributed to a threat actor tracked by the authority as UAC-0063 since 2021, leverages phishing lures to deploy a variety...