PT-2024-26100 · Crane · Crane

Name of the Vulnerable Software and Affected Versions: Crane versions prior to SMR Nov-2024 Release 1 Description: The issue is related to incorrect default permissions, allowing local attackers to access files with phone privilege. Recommendations: For versions prior to SMR Nov-2024 Release 1,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: direnv, vertical-pod-autoscaler-fips, k8sgpt, mockery, lazygit, prometheus-mongodb-exporter-fips, flux-image-reflector-controller, harbor-cli, tigera-operator, aws-efs-csi-driver-fips, kubernetes-csi-livenessprobe, pombump, golangci-lint, ko, prometheus-bind-exporter...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: trivy, k8sgpt, kubeflow-katib, gitsign, flux-image-reflector-controller, helm-operator, argo-workflows-fips, nerdctl, kpt, helm-operator-fips, slsa-verifier, policy-controller, up, kots, skaffold, buildkitd, flux, helm-fips, cri-tools, ctop, guac, scorecard,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: trivy, k8sgpt, kubeflow-katib, gitsign, flux-image-reflector-controller, helm-operator, argo-workflows-fips, nerdctl, kpt, helm-operator-fips, slsa-verifier, policy-controller, up, kots, skaffold, buildkitd, flux, helm-fips, cri-tools, ctop, guac, scorecard,...

USN-5872-1: NSS vulnerabilities

Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. CVE-2022-22747 Ronald Crane discovered that NSS incorrectly handled certain memory operations. A remote attacker...

crane-kit.com Cross Site Scripting vulnerability OBB-3076205

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Advanced Admin Search plugin <= 1.1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Advanced Admin Search plugin versions = 1.1.5. Solution Update the WordPress Advanced Admin Search plugin to the latest available version at least 1.1.6...

WordPress Popup Like box plugin <= 3.6.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Popup Like box plugin versions = 3.6.0. Solution Update the WordPress Popup Like box plugin to the latest available version at least 3.6.1...

WordPress Conference Scheduler plugin <= 2.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Conference Scheduler plugin versions = 2.4.2. Solution Update the WordPress Conference Scheduler plugin to the latest available version at least 2.4.3...

WordPress Delete Old Orders plugin <= 0.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Delete Old Orders plugin versions = 0.2. Solution Deactivate and delete. This plugin has been closed as of February 15, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Mapping multiple URLs redirect same page plugin <= 5.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Mapping multiple URLs redirect same page plugin versions = 5.8. Solution Deactivate and delete. This plugin has been closed as of February 14, 2022 and is not available for download. This closure is temporary,...

WordPress Bank Mellat plugin <= 1.3.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Bank Mellat plugin versions = 1.3.7. Solution Deactivate and delete. This plugin has been closed as of February 16, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress AP Mega Menu plugin <= 3.0.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress AP Mega Menu plugin versions = 3.0.7. Solution Update the WordPress AP Mega Menu plugin to the latest available version at least 3.0.8...

WordPress AP Pricing Tables Lite plugin <= 1.1.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress AP Pricing Tables Lite plugin versions = 1.1.4. Solution Update the WordPress AP Pricing Tables Lite plugin to the latest available version at least 1.1.5...

WordPress Countdown & Clock plugin <= 2.2.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Countdown & Clock plugin versions = 2.2.8. Solution Update the WordPress Countdown & Clock plugin to the latest available version at least 2.2.9...

BEC Gang Exploits G Suite, Long Domain Names in Cyberattacks

Business email compromise BEC attacks continue to be a thorn in companies’ sides, with the FBI in its IC3 annual cybercrime report saying that the attacks cost victims $1.7 billion in 2019. Making matters worse, BEC cybergangs are turning to new tactics and tricks to avoid detection and capitaliz...

crane-tec.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1150117 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting crane-tec.com website and...

Podcast: Behind-the-Scenes Look at Scattered Canary BEC Cybergang

LONDON, U.K. – At Infosecurity Europe, Threatpost caught up with Agari researchers to discuss their threat research unveiled at the show about a newly-unveiled business email compromise BEC cybergang. The cybercriminal group, which researchers called Scattered Canary, has been evolving for over 1...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...