CVE-2023-49111 Reflected Cross-Site-Scripting in Kiuwan SAST

For Kiuwan installations with SSO single sign-on enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is...

A week in security (June 10 – June 16)

Last week on Malwarebytes Labs: Truist bank confirms data breach Update now! Google Pixel vulnerability is under active exploitation Adobe clarifies Terms of Service change, says it doesn’t train AI on customer content 23andMe data breach under joint investigation in two countries When things go...

Google's Privacy Sandbox Accused of User Tracking by Austrian Non-Profit

Google's plans to deprecate third-party tracking cookies in its Chrome web browser with Privacy Sandbox has run into fresh trouble after Austrian privacy non-profit noyb none of your business said the feature can still be used to track users. "While the so-called 'Privacy Sandbox' is advertised a...

WordPress Woody ad snippets Plugin <= 2.5.0 is vulnerable to Remote Code Execution (RCE)

Software Woody ad snippets Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-3105 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID dce238499b1e Credits Webbernaut Required privilege...

@pnp/nodejs (>=4.0.0 <=4.1.1-v4nightly.20240617), insomnia-plugin-azure-ad-authentication (=1.1.2) potentially affected by CVE-2024-35255 via @azure/msal-node (>=2.7.0 <=2.9.1)

@azure/msal-node NPM version =2.7.0, =4.0.0, =4.1.1-v4nightly.20240617 - insomnia-plugin-azure-ad-authentication =1.1.2 Source cves: CVE-2024-35255 Source advisory: OSV:GHSA-M5VV-6R4H-3VJ9...

Google&#8217;s Chrome changes make life harder for ad blockers

Despite protests, Google is rolling out changes in the Chrome browser that make it harder for ad blockers to do their job. Starting last Monday, June 3, 2024, Chrome Beta, Dev, and Canary channels will see the effects of the implementation of the new extension platform Manifest V3. The gradual...

CVE-2024-34802

Missing Authorization vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5...

CVE-2024-34802

Missing Authorization vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5...

CVE-2024-34802

CVE-2024-34802 is a Missing Authorization vulnerability in the WordPress plugin “AdFoxly – Ad Manager, AdSense Ads & Ads.Txt” affecting versions up to 1.8.5. Connected sources corroborate the same description (Red Hat CVE entry RH:CVE-2024-34802; NVD entry CVE-2024-34802). The NVD entry reports a...

CVE-2024-35751

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10...

CVE-2024-35751

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10...

CVE-2024-35751 WordPress Woody code snippets plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10...

CVE-2024-35751

Technical details for CVE-2024-35751 ( Woody code snippets plugin, affected version range, XSS impact, and fixes) are not provided in the supplied Connected Documents. Monitor for updates.

WordPress plugin Woody ad snippets cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-26705 · Unknown · Woody Ad Snippets

Name of the Vulnerable Software and Affected Versions: Woody ad snippets versions n/a through 2.4.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. No information is...

WordPress Woody ad snippets Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Woody ad snippets Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35751 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fea34aee9079 Credits savphill Required privilege...

Malicious code in @juiggitea/vel-ad-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7139bc201f51d17b197242d76fbc388aba5b238053c72cb427cbc25d605a85e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1496 Malicious code in @juiggitea/vel-ad-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7139bc201f51d17b197242d76fbc388aba5b238053c72cb427cbc25d605a85e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization

Description The AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Exposure Of Sensitive Information To An Unauthorized Actor

Mattermost is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to a lack of proper authorization checks in the /api/v4/groups//channels//link endpoint, allowing users to learn members of an AD/LDAP group linked to a team by adding the group to a...