CVE-2023-52185 WordPress Everest Backup Plugin <= 2.1.9 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9...

CVE-2023-51688

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2...

CVE-2023-51688

CVE-2023-51688 affects the eCommerce Product Catalog Plugin for WordPress by impleCode. The vulnerability is described as Exposure of Sensitive Information to an Unauthorized Actor, specifically via CSV file exposure for versions up to 3.3.26. Wordfence indicates the issue is real and has a patch...

CVE-2022-44589

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor...

Authentication flaw

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor...

CVE-2022-44589 WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor...

UAC-0099 Utilizes WinRAR Exploit to Deploy LONEPAGE Malware

Summary: UAC-0099, a threat actor, has been involved in persistent attacks targeting Ukraine. These attacks leverage a critical vulnerability in WinRAR to deploy a malware strain known as LONEPAGE. Notably, the threat actor focuses on Ukrainian employees working for organizations outside of...

PT-2023-14512 · Miniorange · Miniorange'S Google Authenticator – Wordpress Two Factor Authentication – 2Fa

Name of the Vulnerable Software and Affected Versions: miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login versions n/a through 5.6.1 Description: The issue is related to the exposure of sensitive information to an...

CVE-2023-50448

In ActiveAdmin aka Active Admin before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data that belongs to another user by making CSV export requests at certain specific times...

Design/Logic Flaw

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4...

Improper Authorization

gitlab:sid is a vulnerable of improper authorization. The vulnerability due to effect of GitLab CE/EE and it does not performs an authorization check when an actor attempts to access. It leads to improper authorization by allow an attacker to leak the owner's Sentry instance projects...

Microsoft Warns of New 'FalseFont' Backdoor Targeting the Defense Sector

Organizations in the Defense Industrial Base DIB sector are in the crosshairs of an Iranian threat actor as part of a campaign designed to deliver a never-before-seen backdoor called FalseFont. The findings come from Microsoft, which is tracking the activity under its weather-themed moniker Peach...

CentOS 7 : open-vm-tools (RHSA-2023:7279)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7279 advisory. - VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges...

CVE-2023-40058

Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager ARM if the threat actor is in the same environment...

Code injection

Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager ARM if the threat actor is in the same environment...

CVE-2023-40058 Sensitive Information Disclosure Vulnerability

Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager ARM if the threat actor is in the same environment...

CVE-2023-40058

CVE-2023-40058 relates to SolarWinds Access Rights Manager (ARM). The connected ZDI advisory documents a vulnerability in ARM that enables remote attackers to bypass authentication through misconfigurations in a RabbitMQ instance, specifically due to hard-coded credentials. This flaw allows unaut...