Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

CVE-2024-23945

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

WordPress Easy Digital Downloads plugin <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download vulnerability

Authenticated Admin+ Arbitrary File Download vulnerability discovered by Sajjad Ahmad jacksparrow in WordPress Plugin Easy Digital Downloads versions = 3.3.2...

CVE-2024-12875

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2024-12875 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2024-12875

CVE-2024-12875 affects the Easy Digital Downloads – eCommerce Payments and Subscriptions made easy WordPress plugin. The vulnerability is a Directory Traversal in the plugin’s file download feature, affecting all versions up to and including 3.3.2. Exploitation requires Administrator-level access...

LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages

A dual Russian and Israeli national has been charged in the United States for allegedly being the developer of the now-defunct LockBit ransomware-as-a-service RaaS operation since its inception in or around 2019 through at least February 2024. Rostislav Panev , 51, was arrested in Israel earlier...

CVE-2024-12875: External Control of File Name or Path

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level acces...

PT-2024-17771 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress versions up to 3.3.2 Description: The issue allows authenticated attackers with Administrator-level access and above to read the contents of arbitrar...

CVE-2024-56059

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through = 0.2.0...

CVE-2024-56059 WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in Mighty Digital Partners allows Object Injection.This issue affects Partners: from n/a through 0.2.0...

PT-2024-36694 · Unknown · Mighty Digital Partners

Name of the Vulnerable Software and Affected Versions: Mighty Digital Partners versions n/a through 0.2.0 Description: The issue is related to an Improperly Controlled Modification of Object Prototype Attributes, also known as 'Prototype Pollution', which allows Object Injection. This enables...

Hacking Digital License Plates

Not everything needs to be digital and "smart." License plates, for example: Josep Rodriguez, a researcher at security firm IOActive, has revealed a technique to “jailbreak” digital license plates sold by Reviver, the leading vendor of those plates in the US with 65,000 plates already sold. By...

CVE-2024-9654

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

CVE-2024-9654

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

CVE-2024-8475 Protection Mechanism Failure in Digital Operation Services' WiFiBurada

Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5...

CVE-2024-8475

CVE-2024-8475 affects Digital Operation Services’ WiFiBurada prior to version 1.0.5. The issue is described as an Authentication Bypass by Assumed-Immutable Data, enabling manipulation of user‑controlled variables. Documented impact is limited to authentication bypass with no explicit exploitatio...

CVE-2024-9654

CVE-2024-9654 concerns Easy Digital Downloads for WordPress (versions 3.1–3.3.4). The issue is Improper Authorization in verify_guest_email, allowing unauthenticated attackers to view other users’ purchase receipts (which include a download link). Exploitation requires knowledge of another custom...

CVE-2024-9654 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

CVE-2024-9654 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...