UBUNTU-CVE-2023-4771

A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information...

FBI and CISA Release Advisory on Scattered Spider Group

Today, the Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA released a joint Cybersecurity Advisory CSA on Scattered Spider—a cybercriminal group targeting commercial facilities sectors and subsectors. The advisory provides tactics, techniques, and...

Scattered Spider

SUMMARY The Federal Bureau of Investigation FBI and Cybersecurity and Infrastructure Security Agency CISA are releasing this joint Cybersecurity Advisory CSA in response to recent activity by Scattered Spider threat actors against the commercial facilities sectors and subsectors. This advisory...

PT-2023-30475 · Woocommerce · Gravity Master Product Enquiry For Woocommerce

Name of the Vulnerable Software and Affected Versions: Gravity Master Product Enquiry for WooCommerce plugin versions prior to 3.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a...

PT-2023-24848

Name of the Vulnerable Software and Affected Versions 10Web SEO by 10Web plugin versions 1.2.9 and earlier Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

PT-2023-30472 · WordPress · Ioannup Edit Woocommerce Templates

Name of the Vulnerable Software and Affected Versions: ioannup Edit WooCommerce Templates plugin versions 1.1.1 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

Credit card skimming on the rise for the holiday shopping season

As we head into shopping season, customers arent the only ones getting excited. More online shopping means more opportunities for cybercriminals to grab their share using scams and data theft. One particular threat were following closely and expect to increase over the next several weeks is credi...

Lace Tempest Exploits Zero-Day in a Strategic Strike on SysAid

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Lace Tempest has been implicated in exploiting a zero-day vulnerability, identified as CVE-2023-47246. This exploitation allows for the execution of code within SysAid on-premise software, leading...

LOYTEC Electronics Insecure Transit / Insecure Permissions / Unauthenticated Access Vulnerabilities

Products from LOYTEC electronics such as Loytec LWEB-802, L-INX Automation Servers, L-IOB I/O Controllers, and L-VIS Touch Panels suffer from improper access control and insecure transit vulnerabilities. + CVE : CVE-2023-46380, CVE-2023-46381, CVE-2023-46382 + Title : Multiple vulnerabilities in...

phpgurukul Teacher Subject Allocation System 安全漏洞

Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the editid parameter of...

PT-2023-30479

Name of the Vulnerable Software and Affected Versions Matthew Muro Restrict Categories plugin versions = 2.6.4 Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-30478 · WordPress · Sendpress Newsletters

Name of the Vulnerable Software and Affected Versions: SendPress Newsletters plugin versions = 1.23.11.6 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

GNU Binutils coffgen.c Component Confidential Data Access DoS

The vulnerability of the coffgen.c component in the GNU Binutils development environment is related to integer overflow. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures using a specially created PE file...

Ducktail fashion week

Ducktail is a malware family that has been active since the second half of 2021 and aims to steal Facebook business accounts. WithSecure and GridinSoft have covered Ducktail attacks: the infostealer spread under the guise of documents relating to well-known companies and brands projects and...

BlazeStealer Malware Uncovered in Python Packages on PyPI

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Python Package Index PyPI repository is infiltrated with number of malicious python packages. These packages masquerade as obfuscation tools, however they harbor BlazeStealer malware, which initiates a...

Buffer Overflows

vlc is vulnerable to Buffer Overflows. An integer underflow vulnerability allows an attacker to exploit a flaw in the way that VLC handles packet lengths to cause a buffer overflow. The attacker could then use the vulnerability to execute arbitrary code on a vulnerable system, steal data, or...

Millenium RAT the $30 Access Ticket to Data Theft

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Millenium RAT, a Win32 executable built on .NET, specifically version 2.4, is available on GitHub for a one-time fee of $30, granting lifetime access. Notably, this RAT is actively developed and has...

PT-2023-30374

Name of the Vulnerable Software and Affected Versions Muneeb Layer Slider plugin versions = 1.1.9.7 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability allows an attacker to inject malicious...

PT-2023-30473 · WordPress · Wpsolutions-Hq Wpdbspringclean

Name of the Vulnerable Software and Affected Versions: WPSolutions-HQ WPDBSpringClean plugin versions 1.6 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

StripedFly Malware Operated Unnoticed for 5 Years, Infecting 1 Million Devices

An advanced strain of malware masquerading as a cryptocurrency miner has managed to fly the radar for over five years, infecting no less than one million devices around the world in the process. That's according to findings from Kaspersky, which has codenamed the threat StripedFly, describing it ...