Meet NIST Compliance Standards Using Automation

Achieve NIST compliance for your business without slowing down your team...

How automation is evolving SecOps—and the real cost of cybercrime

This post is coauthored by Rob May, Founder and Managing Director, ramsac The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin = 1.2.1 versions...

CVE-2023-35048

CVE-2023-35048 affects the WordPress plugin “Booking and Rental Manager for Bike” (also listed as MagePeople Booking and Rental Manager for Woo/Car/etc.) at versions ≤ 1.2.1. The root cause is improper input sanitization/escaping of plugin settings, enabling an authenticated (admin+) Stored Cross...

CVE-2023-35048 WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin = 1.2.1 versions...

PT-2023-25115

Name of the Vulnerable Software and Affected Versions MagePeople Team Booking and Rental Manager for Bike plugin versions 1.2.1 and earlier Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations For...

CVE-2023-35048: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin = 1.2.1 versions...

CVE-2023-27414

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Popup Box Team Popup box plugin = 3.4.4 versions...

WordPress BookIt 2.3.7 Authentication Bypass

On May 22, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in StylemixThemes’s BookIt plugin, which is actively installed on more than 10,000 WordPress websites. The vulnerability makes it possible for...

AssetRegistry.swapRegistered can be called with low gas to make basket be disabled

Lines of code Vulnerability details Impact Attacker can disable basket, when swapping or unregistering not basket asset. Proof of Concept AssetRegistry.swapRegistered and AssetRegistry.unregister are both functions that can be called by governance only. It's possible that after proposal is passed...

CVE-2023-27414: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Popup Box Team Popup box plugin = 3.4.4 versions...

CVE-2023-35882

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

CVE-2023-35882

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

CVE-2023-35882 WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

CVE-2023-35882

CVE-2023-35882 is a stored XSS vulnerability in WordPress plugin Team Heateor Super Socializer (≤7.13.52). The issue affects users with contributor or higher privileges, allowing injection of scripts via stored payloads. Patch guidance from multiple sources indicates the fix is in version 7.13.53...

Rogue Android Apps Target Pakistani Individuals in Sophisticated Espionage Campaign

Individuals in the Pakistan region have been targeted using two rogue Android apps available on the Google Play Store as part of a new targeted campaign. Cybersecurity firm Cyfirma attributed the campaign with moderate confidence to a threat actor known as DoNot Team, which is also tracked as...

Rogue Android Apps Target Pakistani Individuals in Sophisticated Espionage Campaign

Individuals in the Pakistan region have been targeted using two rogue Android apps available on the Google Play Store as part of a new targeted campaign. Cybersecurity firm Cyfirma attributed the campaign with moderate confidence to a threat actor known as DoNot Team, which is also tracked as...

CVE-2023-35882: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

PT-2023-25361 · WordPress · Team Heateor Super Socializer

Name of the Vulnerable Software and Affected Versions: Team Heateor Super Socializer plugin versions prior to 7.13.53 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. Recommendations: For Team Heateor...