CVE-2024-53982

CVE-2024-53982 affects the Zoo-Project WPS implementation, specifically the Echo example. The vulnerability arises from lack of input validation in a file-caching parameter, enabling an attacker to fully control the file returned in the response (path traversal). A patch was committed on 2024-11-...

APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign

The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor. That's according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google...

The vulnerability of the executable file promecefpluginhost.exe in the Prome CEF SubProcess subsystem of the WPS Office office software package on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the executable file promecefpluginhost.exe from the Prome CEF SubProcess subsystem of the WPS Office office software package on Windows operating systems is related to an incorrect path limitation for accessing the restricted directory. Exploiting this vulnerability could all...

The vulnerability of the apcli_wps_gen_pincode function in the TOTOLINK A6000R router’s microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the apcliwpsgenpincode function in the TOTOLINK A6000R router’s microprogramming system is related to the lack of measures taken to neutralize special elements used in the command when processing the ifname parameter. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the apcli_do_enr_pin_wps function in the microprogramming software of the TOTOLINK A6000R router allows a hacker to execute arbitrary commands.

The vulnerability of the apclidoenrpinwps function in the TOTOLINK A6000R router’s microprogramming software is related to the failure to take measures to neutralize special elements used in the command when processing the ifname parameter. Exploiting this vulnerability can allow a remote attacke...

CVE-2024-33626

The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive information, such as the WiFi WPS PIN, through a hidden page accessible by an HTTP request. Disclosure of this information could enable attackers to connect to the...

LevelOne WBR-6012 Web Application information disclosure vulnerability

Talos Vulnerability Report TALOS-2024-1986 LevelOne WBR-6012 Web Application information disclosure vulnerability October 30, 2024 CVE Number CVE-2024-33626 SUMMARY The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive...

CVE-2024-9628

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.5.4. This makes it possible for authenticated attackers, wit...

CVE-2024-9628

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, wit...

CVE-2024-9630 WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure

The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API...

CVE-2024-9628

CVE-2024-9628 affects the WordPress plugin WPS Telegram Chat . The vulnerability arises from a missing capability check in the function Wps_Telegram_Chat_Admin::checkСonnection , in versions up to and including 4.5.4 . This design flaw enables authenticated attackers with subscriber-level access ...

CVE-2024-9630

The CVE-2024-9630 entry concerns the WPS Telegram Chat plugin for WordPress. Affected versions: up to 4.5.4. Root cause: missing capability check when accessing messages, resulting in an authorization bypass. Impact: unauthenticated attackers can view messages sent through the Telegram Bot API (i...

CVE-2024-9630 WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure

The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API...

CVE-2024-9628 WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, wit...

CVE-2024-9628 WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, wit...

PT-2024-39728 · WordPress · Wps Telegram Chat

Name of the Vulnerable Software and Affected Versions: WPS Telegram Chat plugin for WordPress versions up to, and including, 4.5.4 Description: The issue allows authenticated attackers with subscriber-level access and above to have full access to the Telegram Bot API endpoint and communicate with...

WordPress plugin WPS Telegram Chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin WPS Telegram Chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WPS Telegram Chat plugin <= 4.5.4 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API vulnerability

Authenticated Subscriber+ Unauthorized Access to Telegram Bot API vulnerability discovered by István Márton in WordPress Plugin WPS Telegram Chat versions = 4.5.4...

WordPress WPS Telegram Chat Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software WPS Telegram Chat Type Plugin Vulnerable versions = 4.5.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9630 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9cb16fad33b1 Credits István Márton Required privile...