508 matches found
A week in security (December 9 – December 15)
Last week on Malwarebytes Labs: Encrypted messaging service intercepted, 2.3 million messages read by law enforcement TikTok ban in US: Company seeks emergency injunction to prevent it Data brokers should stop trading health and location data, new bill proposes Update now! Apple releases new...
PT-2024-36331 · Bluesky · Blueskyy Wp-Ban-User
Name of the Vulnerable Software and Affected Versions: blueskyy WP-Ban-User versions 1.0 and earlier Description: A Cross-Site Request Forgery CSRF issue in blueskyy WP-Ban-User allows Stored XSS. This means an attacker can perform actions on behalf of a user without their knowledge, potentially...
WordPress plugin WP-Ban-User 请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...
WordPress WP-Ban-User plugin <= 1.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin WP-Ban-User versions = 1.0...
TikTok ban in US: Company seeks emergency injunction to prevent it
TikTok has requested an emergency injunction to stop or postpone the planned ban on the platform in the US. Back in March, the House of Representatives passed a bill that would effectively ban TikTok from the US unless Chinese owner ByteDance agreed to give up its share of the immensely popular...
MAL-2024-11122 Malicious code in req-ip-ban (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42ccb3d9a195046654b07e64e09e577fa33552b38ebea8854c5fffc5fed5043f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
TikTok ordered to close Canada offices following “national security review”
The Government of Canada ordered the TikTok Technology Canada Inc. to close its offices in the country following a national security review. This decision was made in accordance with the Investment Canada Act, which allows for the review of foreign investments that may be injurious to Canada’s...
Canada Orders TikTok to Shut Down Canadian Operations Over Security Concerns
The Canadian government on Wednesday ordered ByteDance-owned TikTok to dissolve its operations in the country, citing national security risks, but stopped short of instituting a ban on the popular video-sharing platform. "The decision was based on the information and evidence collected over the...
Malicious code in req-ban (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a9a1ab6f28d706cb286af274f9118a3e68076a1daca8d0c34a9499b9cbca5af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10250 Malicious code in req-ban (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a9a1ab6f28d706cb286af274f9118a3e68076a1daca8d0c34a9499b9cbca5af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Drupal Smart IP Ban module < 7.x-1.1 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by Shawn Gants in WordPress Module Smart IP Ban versions 7.x-1.1...
Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041
The Smart IP Ban module enables a site to automatically ban an IP address based upon too many failed authentications. The module doesn't sufficiently protect access to certain paths provided by the module allowing a malicious user to view and modify the settings...
PT-2025-2092 · Drupal · Drupal Cms +1
Name of the Vulnerable Software and Affected Versions: Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0 Description: The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can le...
The vulnerability of the admin_group_member function in the Group Member Handler component of the Git-based software development platform, which allows for collaborative code development on GitLab, enables a hacker to ban arbitrary members of a group.
The vulnerability of the admingroupmember function in the Group Member Handler component of the Git-based software development platform, which is used for collaborative code development on GitLab, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious...
Kaspersky Exits U.S. Market Following Commerce Department Ban
Russian security vendor Kaspersky has said it's exiting the U.S. market nearly a month after the Commerce Department announced a ban on the sale of its software in the country citing a national security risk. News of the closure was first reported by journalist Kim Zetter. The company is expected...
UBUNTU-CVE-2024-2880
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with admingroupmember custom role permission could ban group members...
CVE-2024-2880 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with admingroupmember custom role permission could ban group members...
CVE-2024-2880 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with admingroupmember custom role permission could ban group members...
MAL-2024-7600 Malicious code in sap-ban (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f5c6aac6baea6c693c35b46c3c06e00f63a8c369ccf2dda1061322e7056c932f The OpenSSF Package Analysis project identified 'sap-ban' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...
Malicious code in sap-ban (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f5c6aac6baea6c693c35b46c3c06e00f63a8c369ccf2dda1061322e7056c932f The OpenSSF Package Analysis project identified 'sap-ban' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...