CVE-2023-24008

CVE-2023-24008 : CSRF vulnerability in the WordPress plugin yonifre Maspik – Spam Blacklist (versions

WordPress plugin Maspik – Spam Blacklist 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2023-19358 · Unknown · Yonifre Maspik – Spam Blacklist

Name of the Vulnerable Software and Affected Versions: yonifre Maspik – Spam Blacklist plugin versions prior to 0.7.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a...

CVE-2023-24008: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in yonifre Maspik – Spam Blacklist plugin = 0.7.8 versions...

Interview With a Crypto Scam Investment Spammer

Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. What follows is an interview with a Russian hacker responsible for a series of aggressive crypto spam campaigns that recently prompted several...

MSC-2023-13345

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

WordPress Stop Referrer Spam Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Stop Referrer Spam Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-33207 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c0402f6da021 Credits Mika Required...

U.S. Dept Of Defense: Automatic Admin Access

The automatic administrative access vulnerability allowed a user to access the application with full administrative privileges, including the ability to create submissions, manage users, and access sensitive data. The vulnerability impacted the integrity, confidentiality, and availability of the...

Google Announces New Privacy, Safety, and Security Features Across Its Services

Google unveiled a slew of new privacy, safety, and security features today at its annual developer conference, Google I/O. The tech giant's latest initiatives are aimed at protecting its users from cyber threats, including phishing attacks and malicious websites, while providing more control and...

Google Announces New Privacy, Safety, and Security Features Across Its Services

Google unveiled a slew of new privacy, safety, and security features today at its annual developer conference, Google I/O. The tech giant's latest initiatives are aimed at protecting its users from cyber threats, including phishing attacks and malicious websites, while providing more control and...

WordPress Block Referer Spam Plugin <= 1.1.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Block Referer Spam Type Plugin Vulnerable versions = 1.1.9.4 Fixed in 1.1.9.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32497 Patch priority Low CVSS severity Low 5.1 Developer Claim ownership PSID 9bfabf6d69ec Credits Taihei Shimamine...

WordPress Zero Spam Plugin <= 5.4.4 is vulnerable to SQL Injection

Software Zero Spam Type Plugin Vulnerable versions = 5.4.4 Fixed in 5.4.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-32121 Patch priority Low CVSS severity Low 7.6 Developer Highfivery PSID e207350207ef Credits OZ1NG TOOR, LISA Required privilege Administrator Published ...

WordPress Formidable Forms Builder Plugin < 6.1 Authentication Bypass Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:strategy11:formidableformbuilder"; ifdescription...

No rate limit on send report functionality results in an email spam

Description There is no rate limit on the send report feature on the https://rdiffweb-dev.ikus-soft.com/prefs/notification endpoint , which allows an attacker to spam the victims mailbox Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/notification 2 Click on daily frequency for...

PT-2023-3042 · Triangle Microworks · Scada Data Gateway

Name of the Vulnerable Software and Affected Versions: Triangle MicroWorks' SCADA Data Gateway version = v5.01.03 Description: The issue is related to the lack of authentication for a critical function in the WebMonitor component of the SCADA Data Gateway. An unauthenticated attacker can send...

Threat Source newsletter (April 27, 2023) — New Cisco Secure offerings and extra security from Duo

Welcome to this weeks edition of the Threat Source newsletter. Im writing this earlier in the week as I get ready for some personal travel everyone is lucky I passed on writing another Cybersecurity Mock Draft, so apologies if I miss anything major that happens at RSA. But Cisco beat everyone to...

MSC-2023-13846

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

SMTP server credentials are returned

Description The vulnerability discovered in the Calibre-Web application is a security flaw in the management of email configurations that allows the SMTP server credentials to be viewed by an account with editing permission. This could allow a malicious user with access to the administrative...

PT-2023-3111

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 9.5.3 Grafana versions prior to 9.4.12 Grafana versions prior to 9.3.15 Grafana versions prior to 9.2.19 Grafana versions prior to 8.5.26 Description Grafana is an open-source platform for monitoring and observability...

QBot banker delivered through business correspondence

In early April, we detected a significant increase in attacks that use banking Trojans of the QBot family aka QakBot, QuackBot, and Pinkslipbot. The malware would be delivered through e-mail letters written in different languages — variations of them were coming in English, German, Italian, and...