PT-2023-16545 · WordPress · Formidable Forms

Name of the Vulnerable Software and Affected Versions: Formidable Forms WordPress plugin versions prior to 6.1 Description: The issue allows IP Address spoofing and bypass of anti-spam protections by using several potentially untrusted headers to determine the client's IP address. Recommendations...

CVE-2023-22716

Auth. admin+ Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin = 1.1.35 versions...

Cross site scripting

Auth. admin+ Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin = 1.1.35 versions...

CVE-2023-22716

CVE-2023-22716 affects WordPress OOPSpam Anti-Spam plugin, versions

CVE-2023-22716 WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin = 1.1.35 versions...

CVE-2023-22716 WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin = 1.1.35 versions...

PT-2023-18659 · Unknown · Oopspam Anti-Spam Plugin

Name of the Vulnerable Software and Affected Versions: OOPSpam Anti-Spam plugin versions 1.1.35 and earlier Description: The issue is related to an Authenticated admin+ Cross-Site Scripting vulnerability. There is no information provided about the estimated number of potentially affected devices...

WordPress Plugin OOPSpam Anti-Spam 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2023-22716: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin = 1.1.35 versions...

Emotet resumes spam operations, switches to OneNote

Emotet resumed spamming operations on March 7, 2023, after a months-long hiatus. Initially leveraging heavily padded Microsoft Word documents to attempt to evade sandbox analysis and endpoint protection, the botnets switched to distributing malicious OneNote documents on March 16. Since returning...

Mispadu Banking Trojan Targets Latin America: 90,000+ Credentials Stolen

A banking trojan dubbed Mispadu has been linked to multiple spam campaigns targeting countries like Bolivia, Chile, Mexico, Peru, and Portugal with the goal of stealing credentials and delivering other payloads. The activity, which commenced in August 2022, is currently ongoing, the Ocelot Team...

Mispadu Banking Trojan Targets Latin America: 90,000+ Credentials Stolen

A banking trojan dubbed Mispadu has been linked to multiple spam campaigns targeting countries like Bolivia, Chile, Mexico, Peru, and Portugal with the goal of stealing credentials and delivering other payloads. The activity, which commenced in August 2022, is currently ongoing, the Ocelot Team...

Emotet Rises Again: Evades Macro Security via OneNote Attachments

The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems. Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542,...

MSC-2023-14195

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

Threat Roundup for March 10 to March 17

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 10 and March 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Emotet Returns, Now Adopts Binary Padding for Evasion

Following a three-month hiatus, Emotet spam activities resumed in March 2023, when a botnet known as Epoch 4 began delivering malicious documents embedded in Zip files that were attached to the emails...

Formidable Forms < 6.1 - IP Spoofing

The plugin uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections. PoC 1. In WordPress's Settings Discussion page, add your IP address to the Disallowed Comment Keys field. This will block form...

Maspik – Spam blacklist < 0.7.9 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions in the file /admin/partials/contact-forms-anti-spam-log.php against CSRF attacks, allowing an unauthenticated attacker to clear plugin logs and stat counter by tricking a logged in user to submit a crafted request...

WordPress Maspik – Spam blacklist Plugin <= 0.7.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Maspik – Spam blacklist Type Plugin Vulnerable versions = 0.7.8 Fixed in 0.7.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24008 Patch priority Low CVSS severity Low 4.3 Developer Yonifre PSID 06c51ed7d4f7 Credits Mika Required...

Proven Techniques for Effective Email Spam Filtering

By Waqas In this article, we’ll dive into the world of spam emails, highlighting the reason that email service providers are so vigilant and exploring exactly how marketing teams can prevent ending up in the spam pile. This is a post from HackRead.com Read the original post: Proven Techniques for...