WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Arbitrary File Upload to Remote Code Execution (RCE) vulnerability

Authenticated Arbitrary File Upload to Remote Code Execution RCE vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event. Edit WPScanTeam January 22nd, 2021...

CVE-2020-4786

creationtimestamp| type| source ---|---|--- 2021-01-27 20:37:34+00:00| seen| https://t.me/cibsecurity/22738 2021-07-07 14:28:57+00:00| published-proof-of-concept| https://t.me/ptswarm/51 2021-12-01 20:35:33+00:00| seen| https://t.me/cibsecurity/33217...

WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

CVE-2021-0202 Junos OS: MX Series, EX9200 Series: Trio-based MPC memory leak when Integrated Routing and Bridging (IRB) interface is mapped to a VPLS instance or a Bridge-Domain

On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPC Modular Port Concentrator where Integrated Routing and Bridging IRB interface is configured and it is mapped to a VPLS instance or a Bridge-Domain, certain network events at Customer Edge CE device may cause memory leak...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking online as part of Western Washington Universitys Internet Studies Lecture Series on January 20, 2021. Im speaking online at ITU Denmark on February 2, 2021. Details to come. Im being interviewed by Keith Cronin as part ...

CVE-2021-1645

creationtimestamp| type| source ---|---|--- 2021-01-12 23:01:27+00:00| seen| https://t.me/cibsecurity/22039 2021-05-30 02:31:06+00:00| seen| https://t.me/pwnwikizhchannel/532...

Unbreakable Enterprise kernel security update

4.1.12-124.46.4.1 - target: fix XCOPY NAA identifier lookup Mike Christie Orabug: 32248041 CVE-2020-28374 4.1.12-124.46.4 - xen/events: block rogue events for some time Juergen Gross Orabug: 31984335 CVE-2020-27673 - xen/events: defer eoi in case of excessive number of events Juergen Gross Orabug...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.404.1.1.el7 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1.el7 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch...

Unbreakable Enterprise kernel security update

4.1.12-124.46.3 - mwifiex: fix possible heap overflow in mwifiexprocesscountryie Ganapathi Bhat Orabug: 30781859 CVE-2019-14895 CVE-2019-14895 - ext4: fix ext4emptydir for directories with holes Jan Kara Orabug: 31265320 CVE-2019-19037 CVE-2019-19037 - netlabel: cope with NULL catmap Paolo Abeni...

Fortinet FortiOS Information Disclosure Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An information disclosure...

GE Reason RT43X Clocks

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: Reason RT43X Clocks Vulnerabilities: Code Injection, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

A week in security (December 28 – January 3)

First off we would like to wish all our readers a happy and secure 2021! Last week on Malwarebytes Labs we presented an overview of developments in the SearchDimension hijackers, we looked at the most enticing cyberattacks of 2020, and we also looked back at the strangest cybersecurity events of...

Information Disclosure

xen is vulnerable to information disclosure. The vulnerability exists as a guest administrator can observe non-sensitive domain and device lifecycle events relating to other guests...

The strangest cybersecurity events of 2020: a look back

This year is finally coming to an end, and it only took us about eight consecutive months of March to get here. There is a ton to talk about, and that’s without even discussing the literal global pandemic. You see, 2020s news stories were the pressure-cooker product of mania, chaos, and the...

iPhone Calendar Events spam is back: Here’s how to get rid of it

By Asad Remember the old annoying iPhone Calendar Events Spam? It’s back and worse than before. This is a post from HackRead.com Read the original post: iPhone Calendar Events spam is back: Here’s how to get rid of it...

DEBIAN-CVE-2018-15641

Cross-site scripting XSS issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes...

CVE-2018-15641

Cross-site scripting XSS issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes...

CVE-2020-28448

creationtimestamp| type| source ---|---|--- 2020-12-22 16:52:59+00:00| seen| https://t.me/cibsecurity/21155 2020-12-22 16:53:00+00:00| seen| https://t.me/cibsecurity/21156...

CVE-2020-29491

creationtimestamp| type| source ---|---|--- 2020-12-21 17:59:56+00:00| seen| https://t.me/thehackernews/949 2020-12-22 13:47:00+00:00| seen| https://t.me/informationsecuritychannel/42441 2020-12-22 16:34:26+00:00| seen| https://t.me/YemenShield/684 2020-12-23 11:54:13+00:00| seen|...