Stop using phishing as a measure of your cyber awareness culture

If I had a penny for every time someone said to me “let’s measure our security culture by phishing our staff” I’d probably be able to fill my car up. It’s a really easy thing to do, you carry out some online training and typically they come with phishing simulations as a free or low cost add on. ...

CVE-2022-1951 Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting

The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected...

keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available...

Malicious code in update-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3f9fa9c284383c1fface08dac2e3403531ad755e12ccae85304111523c0adfb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6801 Malicious code in update-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3f9fa9c284383c1fface08dac2e3403531ad755e12ccae85304111523c0adfb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cd-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80411614be3890102b160ef818a9b0b85a5137c864c35011fe443581023b86a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1851 Malicious code in cd-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80411614be3890102b160ef818a9b0b85a5137c864c35011fe443581023b86a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epic-ue-themes-la (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dd6b1635c8fd79c366882517043249a5f5f29688531b8a26db7a8cf43a43671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2772 Malicious code in epic-ue-themes-la (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dd6b1635c8fd79c366882517043249a5f5f29688531b8a26db7a8cf43a43671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Core plugin for Kitestudio themes <= 2.3.0 - Reflected Cross-Site-Scripting (XSS) vulnerability

Reflected Cross-Site-Scripting XSS vulnerability discovered by cydave in WordPress Core plugin for Kitestudio themes versions = 2.3.0. Solution Update the WordPress Core plugin for Kitestudio themes to the latest available version at least 2.3.1...

Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting. Install and active the...

CVE-2022-1657

Vulnerable versions of the Jupiter = 6.10.1 and JupiterX = 2.0.6 Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterxcploadpaneaction AJAX action present in the...

MAL-2022-1668 Malicious code in brave-chromium-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d79eeeb9331ecccff7119c01e7502067dbecc674a2d97d5168e7aba1d126925d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brave-chromium-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d79eeeb9331ecccff7119c01e7502067dbecc674a2d97d5168e7aba1d126925d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover

A critical privilege escalation flaw found in two themes used by more than 90,000 WordPress sites can allow threat actors to take over the sites completely, researchers have found. WordFence Threat Intelligence Team researcher Ramuel Gall discovered the flaw, one of five vulnerabilities he found...

new packages: gnome-themes-extra

An update is available for gnome-themes-extra. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-2F6R-892P-69G5 GeniXCMS arbitrary PHP code execution

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

GeniXCMS arbitrary PHP code execution

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

Thousands of WordPress Sites Hacked to Redirect Visitors to Scam Sites

Cybersecurity researchers have disclosed a massive campaign that's responsible for injecting malicious JavaScript code into compromised WordPress websites that redirects visitors to scam pages and other malicious websites to generate illegitimate traffic. "The websites all shared a common issue —...

CVE-2022-28783

Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permission. The patch adds proper validation logic for removing package name...