CVE-2024-9821

CVE-2024-9821 : The WordPress plugin “Bot for Telegram on WooCommerce” is vulnerable to sensitive information disclosure due to missing authorization checks on the stm_wpcfto_get_settings AJAX action, affecting all versions up to 1.2.4. Authenticated attackers with subscriber-level access and abo...

WordPress plugin Bot for Telegram on WooCommerce 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

PT-2024-39866 · WordPress · The Bot For Telegram On Woocommerce

Name of the Vulnerable Software and Affected Versions: The Bot for Telegram on WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to sensitive information disclosure due to missing authorization checks on the 'stm wpcfto get settings' AJAX...

CVE-2024-9821: Exposure of Sensitive Information to an Unauthorized Actor

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stmwpcftogetsettings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with...

Exploit for CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Au...

WordPress Bot for Telegram on WooCommerce plugin <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass vulnerability

Authenticated Subscriber+ Telegram Bot Token Disclosure to Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Bot for Telegram on WooCommerce versions = 1.2.7...

WordPress Bot for Telegram on WooCommerce Plugin <= 1.2.4 is vulnerable to Sensitive Data Exposure

Software Bot for Telegram on WooCommerce Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Sensitive Data Exposure CVE CVE-2024-9821 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4a69a61df293 Credits István Márton Required...

Malicious code in hubs-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c72c2b5b928c9cc0211f1440d05124b34af18a3c21c7db1bb0ac7d72d12c39cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in hubs-bot

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9237 Malicious code in hubs-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c72c2b5b928c9cc0211f1440d05124b34af18a3c21c7db1bb0ac7d72d12c39cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9685 Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message

The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftbtestaction' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-9685

The CVE-2024-9685 entry concerns the WordPress plugin Notification for Telegram. Technical details in connected sources show a missing capability check in the nftb_test_action function up to and including version 3.3.1, enabling authenticated users with subscriber-level access to send unauthorize...

CVE-2024-9685: Missing Authorization

The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftbtestaction' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and...

connect-telegram-bot (>=1.0.0, <=1.0.1), nemo (>=3.9.0, <=3.9.1) +1 more potentially affected by CVE-2024-45231 via django (2.2.19)

django PYPI version 2.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - connect-telegram-bot =1.0.0, =3.9.0, =1.0.3, =1.0.6 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

Vulnerable APIs and Bot Attacks Costing Businesses Up to $186 Billion Annually

Organizations are losing between $94 - $186 billion annually to vulnerable or insecure APIs Application Programming Interfaces and automated abuse by bots. That's according to The Economic Impact of API and Bot Attacks report from Imperva, a Thales company. The report highlights that these securi...

CVE-2024-25702

creationtimestamp| type| source ---|---|--- 2024-10-04 21:03:26+00:00| seen| https://t.me/cvedetector/7011...

Cloudflare Thwarts Largest-Ever 3.8 Tbps DDoS Attack Targeting Global Sectors

Cloudflare has disclosed that it mitigated a record-breaking distributed denial-of-service DDoS attack that peaked at 3.8 terabits per second Tbps and lasted 65 seconds. The web infrastructure and security company said it fended off "over one hundred hyper-volumetric L3/4 DDoS attacks throughout...

NuGet Package 'Microsoft.Bot.Builder.AI.QnA' Detection

The remote host has a 'Microsoft.Bot.Builder.AI.QnA' with a Verified NuGet package status and is installed on the remote host. Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc...

NuGet Package 'Microsoft.Bot.Connector' Detection

The remote host has a 'Microsoft.Bot.Connector' with a Verified NuGet package status and is installed on the remote host. Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

NuGet Package 'Microsoft.Bot.Builder.Integration.AspNet.Core' Detection

The remote host has a 'Microsoft.Bot.Builder.Integration.AspNet.Core' with a Verified NuGet package status and is installed on the remote host. Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...