14585 matches found
CVE-2023-41325
OP-TEE (Trusted Execution Environment) has a double-free condition in shdr_verify_signature across versions 3.20–3.21, triggered during RSA key memory allocation in sw_crypto_acipher_alloc_rsa_public_key when verifying a TA binary signature. The bug can free memory twice (e) due to non-atomic all...
CVE-2022-38636
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2023-36160
An issue was discovered in Qubo Smart Plug10A version HSP02010114SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console...
Qubo Smart Plug Security Vulnerability
Qubo Smart Plug is a smart plug from Qubo. It effectively manages and tracks the energy consumption of devices through real-time power monitoring. A security vulnerability exists in Qubo Smart Plug version 10A HSP02010114SYSTEM-10 A. The vulnerability stems from a vulnerability that allows an...
Ericsson Mobile Switching Center Server Path Traversal Vulnerability
Ericsson Mobile Switching Center Server is Ericsson's data center server. A security vulnerability exists in Ericsson Mobile Switching Center Server that stems from a directory traversal vulnerability. Affected Products and Versions: Ericsson Mobile Switching Center Server BC version 18A, IS 3.1...
Malware distributor Storm-0324 facilitates ransomware access
The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment. Beginnin...
Security Updates for Microsoft SharePoint Server Subscription Edition (September 2023)
The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by the following vulnerability: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. %NASLMINLEVEL 70300 C...
Security Updates for Outlook (September 2023)
The Microsoft Outlook application installed on the remote host is missing a security update. It is, therefore, affected by an information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. Note that Nessus has not tested for this issue but has...
From Caribbean shores to your devices: analyzing Cuba ransomware
Introduction Knowledge is our best weapon in the fight against cybercrime. An understanding of how various gangs operate and what tools they use helps build competent defenses and investigate incidents. This report takes a close look at the history of the Cuba group, and their attack tactics,...
PT-2023-25461 · Unknown · Qubo Smart Plug 10A
Name of the Vulnerable Software and Affected Versions: Qubo Smart Plug 10A version HSP02 01 01 14 SYSTEM-10A Description: An issue was discovered in the Qubo Smart Plug 10A, allowing attackers to cause a denial of service DoS via Wi-Fi deauthentication. Recommendations: For Qubo Smart Plug 10A...
pohyb-a-pohoda.cz Cross Site Scripting vulnerability OBB-3652052
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-40936
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
WordPress Raise Mag Theme <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)
Software Raise Mag Type Theme Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28621 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef6477e9116b Credits László Radnai Required...
CVE-2023-25465
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy wp tell a friend popup form plugin = 7.1 versions...
CVE-2023-25465 WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy wp tell a friend popup form plugin = 7.1 versions...
CVE-2023-25465
CVE-2023-25465 affects the WordPress plugin wp-tell-a-friend-popup-form (Gopi Ramasamy) for versions <= 7.1. It is an Authenticated (admin+) Stored Cross‑Site Scripting (XSS) vulnerability. Exploitation context and impact are described across multiple sources: Red Hat/NVD entries list an admin...
Chinese-Speaking Cybercriminals Launch Large-Scale iMessage Smishing Campaign in U.S.
A new large-scale smishing campaign is targeting the U.S. by sending iMessages from compromised Apple iCloud accounts with an aim to conduct identity theft and financial fraud. "The Chinese-speaking threat actors behind this campaign are operating a package-tracking text scam sent via iMessage to...
WordPress plugin wp-tell-a-friend-popup-form cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2023-20083 · Gopi Ramasamy · Wp Tell A Friend Popup Form Plugin
Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy wp tell a friend popup form plugin versions = 7.1 Description: The issue is related to an Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with administrative access can inject...
Classiscam Scam-as-a-Service Raked $64.5 Million During the COVID-19 Pandemic
The Classiscam scam-as-a-service program has reaped the criminal actors $64.5 million in illicit earnings since its emergence in 2019. "Classiscam campaigns initially started out on classified sites, on which scammers placed fake advertisements and used social engineering techniques to convince...