MAL-2024-1273 Malicious code in metrics-balancer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c4d7b54aa00bce85364eddf568913642023e355ba669803fa01e20a143e93a47 The OpenSSF Package Analysis project identified 'metrics-balancer' @ 0.2.0 npm as malicious. It is considered malicious because: - The package...

$400 Bounty Awarded for SQL Injection Vulnerability Patched in WP Activity Log Premium WordPress Plugin

🎉 Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! On February 24th, 2024, during our second Bug Bounty Extravaganza...

CVE-2024-0868

The CVE-2024-0868 entry concerns the WordPress coreActivity: Activity Logging plugin for WordPress (versions

CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

CVE-2024-27086

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android e.g., MAUI using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer...

GHSA-X674-V45J-FWXW MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service

!IMPORTANT ONLY applications targeting Xamarin Android and .NET Android MAUI are impacted. All others can safely dismiss this CVE. Impact MSAL.NET applications targeting Xamarin Android and .NET Android e.g., MAUI using the library from versions 4.48.0 to 4.60.3 inclusive, except 4.59.1 and 4.60....

CVE-2024-27086 MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android e.g., MAUI using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer...

CVE-2024-27086 MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android e.g., MAUI using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer...

CVE-2024-27086

MSAL.NET for Xamarin Android and .NET Android (MAUI) is affected when using versions 4.48.0–4.60.0, due to an incorrect activity export configuration that can allow a local attacker on the device to cause a denial of service and block user login to affected apps. The vulnerability is classed as L...

Five Key Takeaways from the 2024 Imperva Bad Bot Report

Bad bots continue to affect consumers and organizations across all sectors. For over eleven years, Imperva has been dedicated to helping organizations manage and mitigate the threat of bad bots. We’ve published the 2024 Imperva Bad Bot Report as part of our commitment to helping organizations...

CVE-2024-29402

CVE-2024-29402 affects cskefu v7 and is caused by Insufficient Session Expiration, enabling an attacker to exploit an old session for malicious activity. Original and connected sources (NVD, Red Hat, CVE list, CNNVD, PTSecurity) confirm the vulnerability and its basic impact profile: CVSS v3.1 ba...

CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

CVE-2024-31219 Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

CVE-2024-31219 Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

Joint Guidance on Deploying AI Systems Securely

Today, the National Security Agency’s Artificial Intelligence Security Center NSA AISC published the joint Cybersecurity Information Sheet Deploying AI Systems Securely in collaboration with CISA, the Federal Bureau of Investigation FBI, the Australian Signals Directorate’s Australian Cyber...

CVE-2024-32137

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Solwin User Activity Log Pro.This issue affects User Activity Log Pro: from n/a through 2.3.4...

CVE-2024-32137 WordPress User Activity Log Pro plugin <= 2.3.4 - Auth. SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Solwin User Activity Log Pro.This issue affects User Activity Log Pro: from n/a through 2.3.4...

CVE-2024-32137 WordPress User Activity Log Pro plugin <= 2.3.4 - Auth. SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Solwin User Activity Log Pro.This issue affects User Activity Log Pro: from n/a through 2.3.4...

CVE-2024-32137

CVE-2024-32137 is an authenticated SQL Injection in Solwin User Activity Log Pro (WordPress plugin) affecting versions up to 2.3.4. The vulnerability stems from improper neutralization of SQL elements, enabling an attacker with LOW privileges and no UI interaction to exploit over the network. The...