A week in security (August 14 - August 20)

Last week on Malwarebytes Labs: Attackers demand ransoms for stolen LinkedIn accounts Patch now! Citrix Sharefile joins the list of actively exploited file sharing software Exchange Server security updates updated Catching up with WoofLocker, the most elaborate traffic redirection scheme to tech...

CVE-2023-29360

creationtimestamp| type| source ---|---|--- 2023-08-19 17:11:13+00:00| published-proof-of-concept| https://t.me/CNArsenal/898 2023-09-04 11:20:17+00:00| published-proof-of-concept| https://t.me/cKure/11502 2023-09-16 14:11:35+00:00| published-proof-of-concept| https://t.me/orderofsixangles/1977...

Fedora 37 : webkitgtk (2023-19754c5a93)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-19754c5a93 advisory. Fix several crashes and rendering issues Security fixes: CVE-2023-38133, CVE-2023-38572, CVE-2023-38592, CVE-2023-38594, CVE-2023-38595,...

WordPress Orders Tracking for WooCommerce Plugin < 1.2.6 is vulnerable to Directory Traversal

Software Orders Tracking for WooCommerce Type Plugin Vulnerable versions 1.2.6 Fixed in 1.2.6 OWASP Top 10 A1: Injection Classification Directory Traversal CVE CVE-2023-4216 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID bbc237527e13 Credits Utkarsh Agrawal Required...

WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking Type Plugin Vulnerable versions = 3.7.1 Fixed in 3.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-40561 Patch priority Low CVSS severity Low 5.4 Developer...

25 most popular websites vs Malwarebytes Browser Guard

Do you know how many see-everything-you're-doing-on-the-web trackers get loaded into your browser when you watch a YouTube video? Would you care to guess? It's about sixty. Sixty. Six zero. Sixty trackers when you load one video. I know this because I decided to take Browser Guard, the...

A new type of "freedom," or, tracking children with AirTags, with Heather Kelly: Lock and Code S04E17

"Freedom" is a big word, and for many parents today, it's a word that includes location tracking. Across America, parents are snapping up Apple AirTags, the inexpensive location tracking devices that can help owners find lost luggage, misplaced keys, and--increasingly so--roving toddlers setting...

WordPress User Activity Tracking and Log Plugin < 4.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software User Activity Tracking and Log Type Plugin Vulnerable versions 4.0.9 Fixed in 4.0.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8eda0dc496af Credits Erwan L...

SUSE: Security Advisory (SUSE-SU-2023:3237-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:3237-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.40.5 bsc1213905: - CVE-2023-38133: Fixed information disclosure. - CVE-2023-38572: Fixed Same-Origin-Policy bypass. - CVE-2023-38592: Fixed arbitrary code execution. - CVE-2023-38594: Fixed arbitrary code execution. -...

CVE-2023-3386

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905...

CVE-2023-3386

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 Camera Trap Tracking System allows SQL Injection.This issue affects Camera Trap Tracking System: before 3.1905...

CVE-2023-3386

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 Camera Trap Tracking System allows SQL Injection.This issue affects Camera Trap Tracking System: before 3.1905...

CVE-2023-3386

CVE-2023-3386 affects the a2 Camera Trap Tracking System prior to version 3.1905. The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands, affecting the product’s ability to protect data and operate reliably. CVSS 3.1 base score 9.8 (Network attack, no ...

CVE-2023-3386 SQLi in a2 Camera Trap Tracking System

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905...

CVE-2023-3386 SQLi in a2 Camera Trap Tracking System

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905...

AlmaLinux 8 : thunderbird (ALSA-2023:4497)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:4497 advisory. - Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file,...

PT-2023-24518

Name of the Vulnerable Software and Affected Versions a2 Camera Trap Tracking System versions prior to 3.1905 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

Code injection

Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use...