17066 matches found
Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these...
Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these...
Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these...
Efficient Infrastructure Testing
Before we start lets set the scene regarding vulnerability assessment. It is imperative that enterprises conduct their own continuous automated scanning, to have up-to-date assessments of threats that their networks may be susceptible to. Infrastructure penetration testing discussed in this blog...
WordPress Team plugin <= 4.1.1 - Authenticated Arbitrary File Read and Deletion vulnerability
Authenticated Arbitrary File Read and Deletion vulnerability discovered by Nhật Nam in WordPress Team plugin versions = 4.1.1. Solution Update the WordPress Team plugin to the latest available version at least 4.1.2...
Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5536-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5536-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could...
Malicious Package
Overview docs-component-create-template is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...
Malicious Package
Overview pod-publishing-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...
A Retrospective on the 2015 Ashley Madison Breach
Its been seven years since the online cheating site AshleyMadison.com was hacked and highly sensitive data about its users posted online. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. To date, little is publicly known about the...
WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
The plugin contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user PoC...
WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
The plugin contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user...
samba -- Multiple vulnerabilities
The Samba Team reports: CVE-2022-2031 The KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password can exploit this to obtain and use tickets to other services. CVE-2022-32744 The KDC...
WordPress wpWax Team Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress wpWax Team 1.2.6 and prior versions, which stems from the program's lack of checksum...
Malicious code in @cobalt-team/multi-invite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e37ea81ad98e89c5f266cfa910ba2604c209fb890e8da13de13eb33951c1948e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-175 Malicious code in @cobalt-team/support-email (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4415fff565dfcd73b3d7b833cb710c1c434e9b840697cb99f753d7b69258c01a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-174 Malicious code in @cobalt-team/multi-invite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e37ea81ad98e89c5f266cfa910ba2604c209fb890e8da13de13eb33951c1948e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-34853
Multiple Authenticated contributor or higher user role Persistent Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...
CVE-2022-34853
Multiple Authenticated contributor or higher user role Persistent Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...