PT-2023-32253 · WordPress · Wp Mail Log

Name of the Vulnerable Software and Affected Versions: WP Mail Log WordPress plugin versions prior to 1.1.3 Description: The issue is related to the improper validation of file path parameters when attaching files to emails, leading to local file inclusion. This allows an attacker to leak the...

JetElements For Elementor < 2.6.13.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Download

Description The JetElements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on an unknown function in all versions up to, and including, 2.6.13. This makes it possible for unauthenticated attackers to download arbitrary attachments...

CVE-2023-49243

Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-49243

Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-49243

CVE-2023-49243 describes a vulnerability in the Huawei HarmonyOS email module that allows unauthorized access to email attachments, potentially affecting service confidentiality. Multiple connected sources confirm the issue stems from an email-attachment handling weakness across Huawei HarmonyOS/...

CVE-2023-49243

Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality...

PT-2023-31130 · Unknown · Email Module

Name of the Vulnerable Software and Affected Versions: Email module affected versions not specified Description: The issue concerns unauthorized access to email attachments within the email module, potentially affecting service confidentiality. Recommendations: At the moment, there is no...

$19 Stanely cups, fake Amazon Prime memberships all part of holiday shopping scams circulating

I know Im a little late to the party to hit the prime SEO for Black Friday, Cyber Monday and holiday shopping. But if I know the readers of this newsletter, everyone is far from done with their holiday shopping already after a few days. I also know Im far from the only person to warn consumers...

PT-2023-30254 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS versions prior to 4.0.1 Description: The issue is related to an Arbitrary File Download vulnerability in the backend attachment management office. Recommendations: For versions prior to 4.0.1, update to version 4.0.1 or later to...

Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine

A coordinated law enforcement operation has led to the arrest of key individuals in Ukraine who are alleged to be a part of several ransomware schemes. "On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne, and Vinnytsia, resulting in the arrest of the 32-year-old...

New Campaign Targets Middle East Governments with IronWind Malware

Government entities in the Middle East are the target of new phishing campaigns that are designed to deliver a new initial access downloader dubbed IronWind. The activity, detected between July and October 2023, has been attributed by Proofpoint to a threat actor it tracks under the name TA402,...

Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers

A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent...

CVE-2023-46743

application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit...

CVE-2023-46743 The same file cannot be opened with different rights

application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit...

CVE-2023-46743

Affected: application-collabora (Collabora Online integration in XWiki). Issue: when a user opens an attachment in edit mode, the userCanWrite result was cached on the Collabora server, causing the edit-right to persist for subsequent users even if they have only view rights. Consequence: the sam...

CVE-2023-46851

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remot...

CVE-2023-46851

CVE-2023-46851 affects Apache Allura 1.0.1–1.15.0, caused by importing attachments without restricting URL values, enabling reading of local files. This exposes internal files and can lead to exploits such as session hijacking or remote code execution. A fix is available in Allura 1.16.0. If upgr...

CVE-2023-46851 Apache Allura: sensitive information exposure via import

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remot...

CVE-2023-4930

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled...

CVE-2023-4930

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled...