CVE-2024-9642

The CVE-2024-9642 entry documents a Stored Cross-Site Scripting (XSS) flaw in the WordPress plugin Editor Custom Color Palette. The vulnerability allows authenticated users with Author-level access or higher to upload SVG files that bypass input sanitization and output escaping, enabling arbitrar...

PT-2024-39735 · WordPress · Editor Custom Color Palette

Name of the Vulnerable Software and Affected Versions: Editor Custom Color Palette plugin for WordPress versions up to, and including, 3.3.7 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access and above ...

SSRF via Custom Tool Testing

This report is not public...

WordPress Editor Custom Color Palette Plugin <= 3.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Editor Custom Color Palette Type Plugin Vulnerable versions = 3.3.7 Fixed in 3.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9642 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d1e22897a97b Credits Francesco...

CVE-2024-20274 Cisco Secure Firewall Management Center HTML Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due ...

CVE-2024-49676

Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through = 0.3.3...

CVE-2024-49658

Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through = 1.0...

CVE-2024-49658

CVE-2024-49658 affects the WordPress plugin WooCommerce Custom Profile Picture (versions ≤ 1.0). The vulnerability is an Unrestricted Upload of File with Dangerous Type that can enable an attacker to upload a web shell to the server. Exploitation requires subscriber-level access; the impact is hi...

CVE-2024-49658 WordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through = 1.0...

CVE-2024-49658 WordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through = 1.0...

CVE-2024-49676

CVE-2024-49676 affects the WordPress plugin Custom Icons for Elementor up to version 0.3.3. It is an Unrestricted Upload of File with Dangerous Type vulnerability that allows uploading a Web Shell to the web server. Root cause: insufficient validation for uploaded files in the plugin, enabling ar...

CVE-2024-49676 WordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through = 0.3.3...

CVE-2024-49676 WordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through = 0.3.3...

Highlighting TA866/Asylum Ambuscade Activity Since 2021

TA866 also known as Asylum Ambuscade is a threat actor that has been conducting intrusion operations since at least 2020. TA866 has frequently relied on commodity and custom tooling to facilitate post-compromise activities. These tools often perform specific functions and are deployed and used as...

PT-2024-33609 · Unknown · Ecomerciar Woocommerce Custom Profile Picture

Name of the Vulnerable Software and Affected Versions: Ecomerciar Woocommerce Custom Profile Picture versions 1.0 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. Recommendations: For...

WordPress plugin Custom Icons for Elementor 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Apache Solr Code Issue Vulnerability

Apache Solr is the United States Apache Apache Foundation of a search server based on Lucene a full-text search engine. The product supports level search , vertical search , highlighting search results and so on. A code issue vulnerability exists in Apache Solr, which stems from the presence of a...

WordPress plugin Woocommerce Custom Profile Picture 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

Chinese Nation-State Hackers APT41 Hit Gambling Sector for Financial Gain

The prolific Chinese nation-state actor known as APT41 aka Brass Typhoon, Earth Baku, Wicked Panda, or Winnti has been attributed to a sophisticated cyber attack targeting the gambling and gaming industry. "Over a period of at least six months, the attackers stealthily gathered valuable informati...

CVE-2024-49321

Missing Authorization vulnerability in colorlibplugins Simple Custom Post Order simple-custom-post-order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order: from n/a through = 2.5.7...