PT-2024-27388 · WordPress · Swift Performance Lite

Name of the Vulnerable Software and Affected Versions: Swift Performance Lite plugin for WordPress versions up to, and including, 2.3.6.18 Description: The issue allows authenticated attackers with subscriber-level access and above to retrieve and modify settings due to a missing capability check...

Desperate Taylor Swift fans defrauded by ticket scams

Ticket scams are very common and apparently hard to stop. When there are not nearly enough tickets for some concerts to accommodate all the fans that desperately want to be there, it makes for ideal hunting grounds for scammers. With a ticket scam, you pay for a ticket and you either don’t receiv...

WordPress Swift Framework plugin <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcodes vulnerability discovered by Francesco Carlucci in WordPress Plugin Swift Framework versions = 2.7.31...

WordPress Swift Framework plugin <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update vulnerability

Missing Authorization to Unauthenticated Arbitrary Content Update vulnerability discovered by Francesco Carlucci in WordPress Plugin Swift Framework versions = 2.7.31...

WordPress Swift Framework Plugin <= 2.7.31 is vulnerable to Cross Site Scripting (XSS)

Software Swift Framework Type Plugin Vulnerable versions = 2.7.31 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3916 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID de1dce8925d6 Credits Francesco Carlucci Requir...

WordPress Swift Framework Plugin <= 2.7.31 is vulnerable to Broken Access Control

Software Swift Framework Type Plugin Vulnerable versions = 2.7.31 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3915 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f340f37317d4 Credits Francesco Carlucci Required...

PT-2024-40754 · Unknown · Swiftprotobuf

Name of the Vulnerable Software and Affected Versions: SwiftProtobuf affected versions not specified Description: The issue is related to a stack-buffer-overflow read in the SwiftProtobuf.TextFormatScanner function. This is indicated by an OSS-Fuzz report, which details a crash type of...

Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update

Description The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sfeditdirectoryitem function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary post...

Swift Framework < 2024.0.0 - Contributor+ Stored XSS via Shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. P...

Swift Framework < 2024.0.0 - Contributor+ Stored XSS via Shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 1...

RHEL 7 : openstack-swift (RHSA-2015:1681)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1681 advisory. OpenStack Object Storage swift provides object storage in virtual containers, which allows users to store and retrieve files arbitrary data. The...

RHEL 7 : openstack-swift (RHSA-2014:0941)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0941 advisory. OpenStack Object Storage Swift provides object storage in virtual containers, which allows users to store and retrieve files arbitrary data. It was...

Malicious code in swift-docc-rendeeeeeer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45e4d71b34d2eb0cd66dc9d19da997d325017d19687f304f39e1138fe0a0f0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1293 Malicious code in swift-docc-rendeeeeeer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45e4d71b34d2eb0cd66dc9d19da997d325017d19687f304f39e1138fe0a0f0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

R2Frida - Radare2 And Frida Better Together

This is a self-contained plugin for radare2 that allows to instrument remote processes using frida. The radare project brings a complete toolchain for reverse engineering, providing well maintained functionalities and extend its features with other programming languages and tools. Frida is a...

CVE-2024-28867

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies un-sanitized string values into metric names or labels, an attacker could make use of this and send a ?lang query parameter containing newlines, or similar...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' due to the usage of un-sanitized string values into metric names or labels. An attacker could exploit this by sending a ?lang query paramet...

CVE-2024-28867 Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies un-sanitized string values into metric names or labels, an attacker could make use of this and send a ?lang query parameter containing newlines, or similar...

CVE-2024-28867

Summary (CVE-2024-28867): Swift Prometheus contains a vulnerability where unsanitized string values used in metric names or labels can be crafted via a ?lang query parameter to inject special characters, potentially leading to unbounded metric growth and memory usage. The issue is described acros...

CVE-2024-28867 Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies un-sanitized string values into metric names or labels, an attacker could make use of this and send a ?lang query parameter containing newlines, or similar...