407 matches found
WordPress Plugin Telegram Bot & Channel 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
PT-2023-24625 · Unknown · Marco Milesi Telegram Bot & Channel
Name of the Vulnerable Software and Affected Versions: Marco Milesi Telegram Bot & Channel plugin versions = 3.6.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Marco Milesi Telegram B...
Dark Pink APT Group Leverages TelePowerBot and KamiKakaBot in Sophisticated Attacks
The threat actor known as Dark Pink has been linked to five new attacks aimed at various entities in Belgium, Brunei, Indonesia, Thailand, and Vietnam between February 2022 and April 2023. This includes educational institutions, government agencies, military bodies, and non-profit organizations,...
WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)
Software Telegram Bot & Channel Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34006 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ffd28984fd7d Credits yuyudhn Required...
CVE-2023-2703
creationtimestamp| type| source ---|---|--- 2023-05-24 00:40:34+00:00| seen| https://t.me/cibsecurity/64659 2025-01-17 16:57:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2164...
CVE-2023-0192
creationtimestamp| type| source ---|---|--- 2023-04-01 12:22:57+00:00| seen| https://t.me/cibsecurity/61296...
CVE-2023-20988
creationtimestamp| type| source ---|---|--- 2023-03-24 23:50:48+00:00| seen| https://t.me/cibsecurity/60708 2025-02-25 21:27:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5388...
CVE-2022-32521
creationtimestamp| type| source ---|---|--- 2023-01-31 02:42:50+00:00| seen| https://t.me/cibsecurity/57181...
Robin Banks Phishing Service for Cybercriminals Returns with Russian Server
A phishing-as-a-service PhaaS platform known as Robin Banks has relocated its attack infrastructure to DDoS-Guard, a Russian provider of bulletproof hosting services. The switch comes after "Cloudflare disassociated Robin Banks phishing infrastructure from its services, causing a multi-day...
CVE-2022-3052
creationtimestamp| type| source ---|---|--- 2022-09-26 20:23:04+00:00| seen| https://t.me/cibsecurity/50513...
How 1-Time Passcodes Became a Corporate Liability
Phishers are enjoying remarkable success using text messages to steal remote access credentials and one-time passcodes from employees at some of the worlds largest technology companies and customer support firms. A recent spate of SMS phishing attacks from one cybercriminal group has spawned a...
CVE-2022-36503
creationtimestamp| type| source ---|---|--- 2022-08-25 18:30:12+00:00| seen| https://t.me/cibsecurity/48748...
CVE-2022-36967
creationtimestamp| type| source ---|---|--- 2022-08-03 02:18:10+00:00| seen| https://t.me/cibsecurity/47451...
Plaintext Storage of a Password in Jenkins Build Notifications Plugin
Build Notifications Plugin 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration:- Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml\n- Slack Bot Token in...
Sysrv-K Botnet Targets Windows, Linux
Unpatched vulnerabilities in the Spring Framework and WordPress plugins are being exploited by cybercriminals behind the Sysrv botnet to target Linux and Windows systems. The goal, according to researchers, is to infect systems with cryptomining malware. The botnet variant is being called Sysrv-K...
New Sysrv Botnet Variant Hijacking Windows and Linux with Crypto Miners
Microsoft is warning of a new variant of the Sysrv botnet that's exploiting multiple security flaws in web applications and databases to install coin miners on both Windows and Linux systems. The tech giant, which has called the new version Sysrv-K, is said to weaponize an array of exploits to ga...
Researchers Warn of "Eternity Project" Malware Service Being Sold via Telegram
An unidentified threat actor has been linked to an actively in-development malware toolkit called the "Eternity Project" that lets professional and amateur cybercriminals buy stealers, clippers, worms, miners, ransomware, and a distributed denial-of-service DDoS bot. What makes this...
A Telegram Bot Told Iranian Hackers When They Got a Hit
APT35 may not be the most dangerous group out there, but they've got a new phishing trick...