CVE-2023-6700 Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update

The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2023-6700

CVE-2023-6700 affects the WordPress plugin Cookie Information | Free GDPR Consent Solution (wp-gdpr-compliance) , with versions ≤ 2.0.22 vulnerable due to a missing capability check in the AJAX handler. This allows authenticated attackers (subscriber-level or higher) to arbitrarily update site op...

WordPress plugin Cookie Information | Free GDPR Consent Solution Security Breach

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-23831

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...

The vulnerability of the TCC (Transparency, Consent, and Control) mechanism in operating systems such as Mac OS, tvOS, watchOS, iOS, and iPadOS allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the TCC Transparency, Consent, and Control mechanism in operating systems such as Mac OS, tvOS, watchOS, iOS, and iPadOS is related to insecure temporary files. Exploiting this vulnerability can allow attackers to bypass security restrictions and gain unauthorized access to...

FTC Bans InMarket for Selling Precise User Location Without Consent

The U.S. Federal Trade Commission FTC is continuing to clamp down on data brokers by prohibiting InMarket Media from selling or licensing precise location data. The settlement is part of allegations that the Texas-based company did not inform or seek consent from consumers before using their...

PT-2024-3896

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.3 watchOS versions prior to 10.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 Description: The issue is related to the Apple Shortcuts app, where a shortcut may be able to use sensitive data with...

Zelle Is Using My Name and Voice without My Consent

Okay, so this is weird. Zelle has been using my name, and my voice, in audio podcast ads--without my permission. At least, I think it is without my permission. Its possible that I gave some sort of blanket permission when speaking at an event. Its not likely, but it is possible. I wrote to Zelle...

Case Study: The Cookie Privacy Monster in Big Global Retail

Explore how an advanced exposure management solution saved a major retail industry client from ending up on the naughty step due to a misconfiguration in its cookie management policy. This wasn't anything malicious, but with modern web environments being so complex, mistakes can happen, and...

CVE-2023-40430

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent...

CVE-2023-40430

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent...

CVE-2023-40430

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent...

FTC Bans Outlogic (X-Mode) From Selling Sensitive Location Data

The U.S. Federal Trade Commission FTC on Tuesday prohibited data broker Outlogic, which was previously known as X-Mode Social, from sharing or selling any sensitive location data with third-parties. The ban is part of a settlement over allegations that the company "sold precise location data that...

Apple macOS Sonoma Security Vulnerability

Apple macOS Sonoma is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Sonoma version 14, which originates from an application that may be able to access removable volumes without user consent...

Cross site scripting

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-6498

CVE-2023-6498 refers to a Stored Cross-Site Scripting vulnerability in the WordPress plugin Complianz – GDPR/CCPA Cookie Consent . The issue arises from insufficient input sanitization and output escaping in admin settings, enabling an authenticated attacker with administrator-level permissions t...

Complianz | GDPR/CCPA Cookie Consent < 6.5.6 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Malicious code in @skip-js/cookie-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5576fae3b0649b388c1eb920f54ed752672ecdd3558a0988c30504346de5f0c2 The OpenSSF Package Analysis project identified '@skip-js/cookie-consent' @ 0.8.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-6 Malicious code in @skip-js/cookie-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5576fae3b0649b388c1eb920f54ed752672ecdd3558a0988c30504346de5f0c2 The OpenSSF Package Analysis project identified '@skip-js/cookie-consent' @ 0.8.0 npm as malicious. It is considered malicious because: - The...

GHSA-6M9R-7WRX-XMR6 Apache Airflow Cross-Site Request Forgery vulnerability

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executi...