This Week in Spring - September 24th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in delightful Dallas, TX, at the amazing JConf.dev show. Then I'm off to Germany, and then back home to do some laundry before heading out to Denver, CO, for the amazing Dev2Next show, before then heading out to Belgium f...

PT-2024-39042 · WordPress · Easy Paypal Events

Name of the Vulnerable Software and Affected Versions: Easy PayPal Events plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is due to missing or incorrect nonce validation on the wpeevent plugin buttons function, making it possible for unauthenticated attackers to...

PT-2024-38322 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9 through 9.3.3 Concrete CMS versions below 8.5.19 Description: The issue is related to stored XSS in the calendar event addition feature. This occurs because the calendar event name was not sanitized on output. Users or...

mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran

The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...

CVE-2023-3129

creationtimestamp| type| source ---|---|--- 2024-09-19 15:32:04+00:00| exploited| https://t.me/FanatixRipperNews/693 2024-09-19 15:32:04+00:00| published-proof-of-concept| Telegram/M-RM6JUeRS-yLbXH47dffFKYpTJTdkiqAiI6xYlcLmjs7Mv7LQ 2024-09-19 15:32:09+00:00| published-proof-of-concept|...

Healthcare's Diagnosis is Critical: The Cure is Cybersecurity Hygiene

Cybersecurity in healthcare has never been more urgent. As the most vulnerable industry and largest target for cybercriminals, healthcare is facing an increasing wave of cyberattacks. When a hospital's systems are held hostage by ransomware, it's not just data at risk — it's the care of patients...

CVE-2024-46725

creationtimestamp| type| source ---|---|--- 2024-09-18 10:02:18+00:00| seen| https://t.me/cvedetector/5924 2025-08-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07 2025-12-03 14:14:49+00:00| seen|...

CVE-2024-46785 eventfs: Use list_del_rcu() for SRCU protected list variable

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use listdelrcu for SRCU protected list variable Chi Zhiling reported: We found a null pointer accessing in tracefs1, the reason is that the variable 'eichild' is set to LISTPOISON1, that means the list was removed in...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup CVE-2024-26687 In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel...

DEBIAN-CVE-2024-8900

An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox 129, Firefox ESR 128.3, and Thunderbird 128.3...

CVE-2024-8900

An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox 129...

CVE-2024-8900

CVE-2024-8900 describes a vulnerability where an attacker could write data to the user’s clipboard, bypassing the user prompt, during a specific sequence of navigational events. Affected products and versions per the provided data are Mozilla Firefox before version 129, Firefox ESR before 128.3, ...

CVE-2024-30038

creationtimestamp| type| source ---|---|--- 2024-09-17 12:32:43+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve202430088authzbasep.rb 2025-02-06 03:13:46+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:11:02+00:00|...

mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran

The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...

CVE-2024-45696

creationtimestamp| type| source ---|---|--- 2024-09-16 10:20:23+00:00| seen| https://t.me/cvedetector/5710 2024-09-17 15:20:05+00:00| seen| https://t.me/truesecator/6215 2024-09-18 08:04:07+00:00| seen| https://t.me/ViralCyber/5597...

Malicious code in events_pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd8e0d60317b9c1b711d6f1dcbf88073cf135c6a018bc578641d68f8bddb270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45186

creationtimestamp| type| source ---|---|--- 2024-09-14 12:47:31+00:00| seen| https://t.me/CyberBulletin/642 2024-09-15 15:58:03+00:00| seen| https://t.me/CyberBulletin/674 2024-09-15 21:05:47+00:00| published-proof-of-concept| https://t.me/HackingInsights/13105 2024-09-21 03:02:54+00:00| seen|...

CVE-2024-8369

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view...

CVE-2024-8369

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view...

CVE-2024-8369

CVE-2024-8369 affects the WordPress plugin EventPrime – Events Calendar, Bookings and Tickets (≤ 4.0.4.3). The vulnerability arises from missing authorization checks, allowing unauthenticated attackers to view private or password-protected events. The issue is classified with a CVSS v3.1 base sco...