WordPress Crypto Plugin <= 2.18 is vulnerable to Broken Authentication

Software Crypto Type Plugin Vulnerable versions = 2.18 Fixed in 2.19 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9988 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 4336600a033e Credits István Márton...

WordPress Crypto Plugin <= 2.15 is vulnerable to Cross Site Request Forgery (CSRF)

Software Crypto Type Plugin Vulnerable versions = 2.15 Fixed in 2.16 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9990 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 9ea8df5f4b5b Credits István Márton Required privileg...

PT-2024-39986

Name of the Vulnerable Software and Affected Versions Crypto plugin for WordPress versions up to, and including, 2.15 Description The issue is related to authentication bypass. This is due to a limited arbitrary method call to crypto connect ajax process::log in function in the crypto connect aja...

WordPress plugin Crypto 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-39987 · WordPress · Crypto++

Name of the Vulnerable Software and Affected Versions: Crypto plugin for WordPress versions up to and including 2.15 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation in the crypto connect ajax process::check function. This allows unauthenticated...

Cybercriminals Use Webflow to Deceive Users into Sharing Sensitive Login Credentials

Cybersecurity researchers have warned of a spike in phishing pages created using a website builder tool called Webflow, as threat actors continue to abuse legitimate services like Cloudflare and Microsoft Sway to their advantage. "The campaigns target sensitive information from different crypto...

ROS-20241028-03

The vulnerability of the quota component of the Linux kernel is related to the NULL pointer dereferencing in the functions dquotmarkdquotdirty, dquotallocspace, dquotallocinode, EXPORTSYMBOL, dquotclaimspacenodirty, dquotreclaimspacenodirty, dquotfreespace, dquotfreeinode, and dquottransfer in...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

podman security update

An update is available for podman. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The podman tool manages pods, container images, and containers. It is part of...

RockyLinux 9 : podman (RLSA-2024:8039)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8039 advisory. go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion CVE-2024-34155 encoding/gob:...

ROS-20241025-01

A vulnerability in the netlink component of the Linux kernel is related to the use of an uninitialized resource in the sizeof function in lib/nlattr.c. uninitialized resource in the sizeof function in lib/nlattr.c. Exploitation of the vulnerability could allow an attacker to cause a denial of...

Lazarus Group Exploits Chrome 0-Day for Crypto with Fake NFT Game

North Korean hackers from Lazarus Group exploited a zero-day vulnerability in Google Chrome to target cryptocurrency investors with…...

Malicious code in @woody-mrs-potato/utils-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a69debf19a38ac2408ae18cd25b408c34eadd0ebd68fe0e06377b9719dd82784 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts

He just untangled a $243 million bitcoin theft, what may be the biggest-ever crypto heist to target a single victim. And he has never shown his face...

Nigeria Drops Charges Against Tigran Gambaryan, Jailed Binance Exec and Former IRS Agent

After eight months, one of the US’s most prominent crypto-crime investigators may finally be coming home...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.14.39 security update

Red Hat OpenShift Container Platform release 4.14.39 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

The vulnerability of the Linux operating system’s crypto kernel component, which allows a hacker to gain unauthorized access to confidential information

The vulnerability of the Linux operating system’s crypto kernel component is related to improper control of resource identifiers. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information within the system...

RHEL 8 / 9 : OpenShift Container Platform 4.14.39 (RHSA-2024:8238)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:8238 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining...

CVE-2024-50047

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption large read crashes with a slab-use-after-free way down in the crypto API. Reproducer: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd if=/mnt/largefile...