Supply Chain Attack on WordPress.org Plugins Leads to 5 Maliciously Compromised WordPress Plugins

On Monday June 24th, 2024 the Wordfence Threat Intelligence team became aware of a plugin, Social Warfare, that was injected with malicious code on June 22, 2024 based on a forum post by the WordPress.org Plugin Review team. We immediately checked the malicious file and uploaded it to our interna...

Exploit for SQL Injection in Opencart

CVE-2024-21514 PoC and Bulk Scanner !Bannerscreens/screen...

Exploit for Code Injection in Xwiki

CVE-2024-31982 PoC and Bulk Scanner !Bannerscreens/scree...

CVE-2023-49113 Sensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer

The Kiuwan Local Analyzer KLA Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer. The JAR file...

PT-2024-13676 · Unknown · Kiuwan Local Analyzer +1

Name of the Vulnerable Software and Affected Versions: Kiuwan SAST version master.1808.p685.q13371 Description: The issue arises when the Kiuwan Local Analyzer uploads scan results to the Kiuwan SAST web application, which processes XML files containing external entities. This leads to an XML...

Exploit for Path Traversal in Hsclabs Mailinspector

CVE-2024-34470 PoC and Bulk Scanner Overview This is a pr...

Exploit for OS Command Injection in Zyxel Nas326_Firmware

CVE-2024-29973 PoC and Bulk Scanner Overview This is a pr...

AlmaLinux 8 : flatpak (ALSA-2024:3961)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:3961 advisory. flatpak: sandbox escape via RequestBackground portal CVE-2024-32462 Tenable has extracted the preceding description block directly from the AlmaLinux security...

GO-2024-2916 SQL Injection in Harbor scan log API in github.com/goharbor/harbor

SQL Injection in Harbor scan log API in github.com/goharbor/harbor...

OpenTelemetry Collector Installed (Linux / Unix)

Binary data opentelemetrynixinstalled.nbin...

CVE-2024-5759

An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges...

CVE-2024-1891

A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page...

CVE-2024-1891

The CVE-2024-1891 entry describes a stored cross-site scripting vulnerability in Tenable Security Center. A authenticated, remote attacker could inject HTML code into a web application scan result page due to inadequate input handling in the affected component/file. Relevant details show impact c...

PT-2024-18398 · Tenable · Tenable Security Center

Name of the Vulnerable Software and Affected Versions: Tenable Security Center affected versions not specified Description: A stored cross site scripting issue exists, allowing an authenticated, remote attacker to inject HTML code into a web application scan result page. Recommendations: At the...

Tenable Security Center Security Breach

Tenable Security Center is a security center from Tenable USA. A security vulnerability exists in Tenable Security Center that stems from the presence of a stored cross-site scripting vulnerability that could allow an authenticated, remote attacker to inject HTML code into a web application scan...

Schneider Electric Modicon M340, BMXNOE0100, and BMXNOE0110 (Update A)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

Fedora 39 : efifs (2024-69933b0732)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-69933b0732 advisory. - Update bundled edk2 to 20240524 2284243 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Harbor SQL Injection Vulnerability

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control, ensuring that images are scanned and free of vulnerabilities, and signing images as trusted. A SQL injection vulnerability exists in Harbor v2.8.4, v2.9.2, and v2.10....

The vulnerability of the Apex One NT RealTime Scan anti-virus software programs Trend Micro Apex One and Apex One as a Service allows attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Apex One NT RealTime Scan antivirus software programs Trend Micro Apex One and Apex One as a Service is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary code...

The vulnerability of the Damage Cleanup Engine of the Trend Micro Common Client Real-time Scan antivirus software, including the Apex One and Apex One as a Service solutions, allows a malicious actor to trigger a service failure.

The vulnerability of the Damage Cleanup Engine of the Trend Micro Common Client Real-time Scan antivirus software, specifically Apex One and Apex One as a Service, is related to an incorrect definition of the link before accessing a file. Exploiting this vulnerability can allow an attacker to...