CVE-2024-32507

CVE-2024-32507 corresponds to a Privilege Escalation in the WordPress plugin “Login with phone number” (Hamid Alinia – idehweb). The issue is described as improper privilege management that enables privilege escalation via the Login with phone number feature for versions affected up to 1.7.16. Pu...

WordPress plugin Login with phone number 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-24624 · Hamid Alinia · Idehweb

Name of the Vulnerable Software and Affected Versions: Hamid Alinia – idehweb versions 1.7.16 and earlier Description: The issue is related to improper privilege management, allowing privilege escalation through the 'Login with phone number' feature. Recommendations: For versions 1.7.16 and...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 allows a perpetrator to disclose protected information.

The vulnerability of the web-based management interface for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 is related to the ability to bypass authentication due to a software bug. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

The vulnerability in the web interface for controlling microprogrammed software-based Cisco IP Phones such as Cisco IP Phone 6800, Cisco IP Phone 7800, Cisco IP Phone 8800, and Cisco Video Phone 8875 allows a perpetrator to initiate telephone calls from the vulnerable device.

The vulnerability of the web-based management interface for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to initiate telephone calls from a vulnerable device using...

Cybercriminals Exploiting Microsoft's Quick Assist Feature in Ransomware Attacks

The Microsoft Threat Intelligence team said it has observed a threat actor it tracks under the name Storm-1811 abusing the client management tool Quick Assist to target users in social engineering attacks. "Storm-1811 is a financially motivated cybercriminal group known to deploy Black Basta...

Android Update: Theft Detection Lock Knows When Your Phone Is Stolen

Google is introducing new AI-powered safety tools in Android 15 that can lock down your phone if thieves nab it...

Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls

Cybersecurity researchers have uncovered an ongoing social engineering campaign that bombards enterprises with spam emails with the goal of obtaining initial access to their environments for follow-on exploitation. "The incident involves a threat actor overwhelming a user's email with junk and...

Fortinet FortiVoice 安全漏洞

Fortinet FortiVoice is a network communications solution from Fortinet, Inc. A security vulnerability exists in Fortinet FortiVoice that originates from an authorization bypass via a user-controlled key vulnerability that allows an authenticated attacker to read another user's SIP configuration v...

College Management System SQL注入漏洞

College Management System is a simple project organized by Code Projects. It is used to keep track of students, teachers, subjects, schedules and all things related to the university. A SQL injection vulnerability exists in College Management System version 1.0, which stems from an SQL injection...

LLMs’ Data-Control Path Insecurity

Back in the 1960s, if you played a 2,600Hz tone into an AT&T pay phone, you could make calls without paying. A phone hacker named John Draper noticed that the plastic whistle that came free in a box of Captain Crunch cereal worked to make the right sound. That became his hacker name, and everyone...

HackerOne: Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery

Vulnerability description not provided...

PT-2024-32947 · Unknown · Kashipara College Management System

Name of the Vulnerable Software and Affected Versions: Kashipara College Management System version 1.0 Description: A critical issue has been found in the Kashipara College Management System, affecting an unknown functionality of the file submit admin.php. The manipulation of the phone argument...

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Co-authored by Rapid7 analysts Tyler McGraw, Thomas Elkins, and Evan McCann Executive Summary Rapid7 has identified an ongoing social engineering campaign that has been targeting multiple managed detection and response MDR customers. The incident involves a threat actor overwhelming a user's emai...

The vulnerability of the Phone Book Access component of the Bluetooth protocol stack for the Linux BlueZ operating system allows a hacker to execute arbitrary code.

The vulnerability of the Phone Book Access component in the Bluetooth protocol stack for the Linux BlueZ operating system is related to buffer overflow attacks. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-34371

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through = 1.7.18...

CVE-2024-34371

CVE-2024-34371 : A Missing Authorization vulnerability affects the WordPress plugin Login with phone number (login-with-phone-number) , reported for versions from n/a up to and including 1.7.18 . The Red Hat and CVE records confirm an unauthorized access issue within this plugin. The entry notes ...

CVE-2024-34371 WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through = 1.7.18...

CVE-2024-34371 WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through = 1.7.18...

Xiaomi Android Devices Hit by Multiple Flaws Across Apps and System Components

Multiple security vulnerabilities have been disclosed in various applications and system components within Xiaomi devices running Android. "The vulnerabilities in Xiaomi led to access to arbitrary activities, receivers and services with system privileges, theft of arbitrary files with system...