CVE-2024-52487

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows Stored XSS.This issue affects Ultimate Classified Listings: from n/a through = 1.7...

CVE-2024-52464

CVE-2024-52464: Reflected XSS in WordPress plugin amr shortcodes (versions 1.7 and earlier). Root cause is improper input handling during web page generation, enabling an attacker-controlled input to be reflected in the output. Affected component: amr shortcodes. Impact: Reflected XSS risk on pag...

CVE-2024-53755

CVE-2024-53755 documents a CSRF-to-Stored XSS vulnerability in the WordPress plugin Third Party Cookie Eraser. Affected versions are listed as n/a through 1.0.2. Root cause is CSRF enabling stored XSS; CVSS-derived context in the initial description indicates a high-severity impact. Remediation r...

CVE-2024-53777

CVE-2024-53777 describes a CSRF-to-Stored XSS vulnerability in the WordPress plugin Simple Header and Footer (versions n/a through 1.0.0). Affected component is the Simple Header and Footer plugin for WordPress; root cause is CSRF enabling stored script execution, potentially impacting users of t...

CVE-2024-53781

CVE-2024-53781 refers to a CSRF-to-Stored XSS vulnerability in the WordPress plugin SpatialMatch IDX (

CVE-2024-53738

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through = 1.3.9.8...

CVE-2024-53738

CVE-2024-53738 describes a Server-Side Request Forgery (SSRF) in the WordPress plugin Asset CleanUp: Page Speed Booster, affected versions are up to 1.3.9.8. The CVE entry notes a MEDIUM severity with CVSSv3.1 base score 4.4 and that the vulnerability affects authenticated users (admin+). Connect...

CVE-2024-52800

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks

Cybersecurity researchers are warning about malicious email campaigns leveraging a phishing-as-a-service PhaaS toolkit called Rockstar 2FA with an aim to steal Microsoft 365 account credentials. "This campaign employs an AitM adversary-in-the-middle attack, allowing attackers to intercept user...

CVE-2024-52337

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.39 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.39 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries

The China-linked threat actor known as Earth Estries has been observed using a previously undocumented backdoor called GHOSTSPIDER as part of its attacks targeting Southeast Asian telecommunications companies. Trend Micro, which described the hacking group as an aggressive advanced persistent...

SUSE-SU-2024:4054-1 Security update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop

This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issues: xmlgraphics-fop was updated from version 2.8 to 2.10: - Security issues fixed: CVE-2024-28168: Fixed improper restriction of XML External Entity XXE reference bsc1231428 -...

CVE-2024-11034

The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via firecontactform AJAX action in all versions up to, and including, 1.4. This is due to the software...

WordPress Request a Quote for WooCommerce and Elementor plugin <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form vulnerability

Unauthenticated Arbitrary Shortcode Execution via firecontactform vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Request a Quote for WooCommerce and Elementor versions = 1.4...

CVE-2024-52471

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in petesheppard84 Extensions for Elementor allows Reflected XSS.This issue affects Extensions for Elementor: from n/a through 2.0.37...

Phobos: Stealthy Ransomware That Operated Under the Radar - Until Now

Phobos: Stealthy Ransomware That Operated Under the Radar - Until Now By Jambul Tologonov, John Fokker and Duy-Phuc Pham · November 20, 2024 On November 18th, the US Justice Department unsealed criminal charges against a Russian national for allegedly administering the sale, distribution, and...

CVE-2024-51883

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through = 1.7.4...

CVE-2024-51846

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Simpson Community Yard Sale community-yard-sale allows Stored XSS.This issue affects Community Yard Sale: from n/a through = 1.1.11...