602 matches found
django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2023-44271 via pillow (2.7.0)
pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2023-44271 Source advisory: OSV:PYSEC-2023-227...
django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2023-4863 +1 more via pillow (2.7.0)
pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:PYSEC-2023-175...
CVE-2023-4945
creationtimestamp| type| source ---|---|--- 2023-09-14 07:24:10+00:00| seen| https://t.me/cibsecurity/70425...
django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2023-4863 +1 more via pillow (2.7.0)
pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:GHSA-J7HP-H8JX-5PPR...
Analyzing a Facebook Profile Stealer Written in Node.js
We analyze an information stealer written in Node.js, packaged into an executable, exfiltrated stolen data via both Telegram bot API and a C&C server, and employed GraphQL as a channel for C&C communication...
New Telegram Bot "Telekopye" Powering Large-scale Phishing Scams from Russia
A new financially motivated operation is leveraging a malicious Telegram bot to help threat actors scam their victims. Dubbed Telekopye, a portmanteau of Telegram and kopye meaning "spear" in Russian, the toolkit functions as an automated means to create a phishing web page from a premade templat...
QwixxRAT: New Remote Access Trojan Emerges via Telegram and Discord
A new remote access trojan RAT called QwixxRAT is being advertised for sale by its threat actor through Telegram and Discord platforms. "Once installed on the victim's Windows platform machines, the RAT stealthily collects sensitive data, which is then sent to the attacker's Telegram bot, providi...
CVE-2023-37873
creationtimestamp| type| source ---|---|--- 2023-08-06 02:12:00+00:00| seen| https://t.me/cibsecurity/67822...
CVE-2023-34006
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Milesi Telegram Bot & Channel plugin = 3.6.2 versions...
CVE-2023-34006
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Milesi Telegram Bot & Channel plugin = 3.6.2 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Milesi Telegram Bot & Channel plugin = 3.6.2 versions...
CVE-2023-34006 WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Milesi Telegram Bot & Channel plugin = 3.6.2 versions...
CVE-2023-34006
CVE-2023-34006 concerns the WordPress plugin “Telegram Bot & Channel” by Marco Milesi, affected versions
CVE-2023-34006: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Milesi Telegram Bot & Channel plugin = 3.6.2 versions...
PT-2023-24625 · Unknown · Marco Milesi Telegram Bot & Channel
Name of the Vulnerable Software and Affected Versions: Marco Milesi Telegram Bot & Channel plugin versions = 3.6.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Marco Milesi Telegram B...
WordPress Plugin Telegram Bot & Channel 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
Dark Pink APT Group Leverages TelePowerBot and KamiKakaBot in Sophisticated Attacks
The threat actor known as Dark Pink has been linked to five new attacks aimed at various entities in Belgium, Brunei, Indonesia, Thailand, and Vietnam between February 2022 and April 2023. This includes educational institutions, government agencies, military bodies, and non-profit organizations,...
WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)
Software Telegram Bot & Channel Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34006 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ffd28984fd7d Credits yuyudhn Required...