Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed PoC Create/edit a Download and put the following payload in the File Name field: Download...

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

The plugin does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack PoC...

Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed Create/edit a Download and put the following payload in the File Name field: Download the...

WordPress Easy Digital Downloads plugin <= 2.11.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Muhamad Hidayat in WordPress Easy Digital Downloads plugin versions = 2.11.5. Solution Update the WordPress Easy Digital Downloads plugin to the latest available version at least 2.11.6...

WordPress Easy Digital Downloads plugin <= 2.11.5 - Arbitrary Payment Note Insertion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Payment Note Insertion via Cross-Site Request Forgery CSRF vulnerability was discovered by Muhamad Hidayat in WordPress Easy Digital Downloads plugin versions = 2.11.5. Solution Update the WordPress Easy Digital Downloads plugin to the latest available version at least 2.11.6...

[SECURITY] Fedora 36 Update: libwebp-1.2.2-4.fc36

WebP is an image format that does lossy compression of digital photographic images. WebP consists of a codec based on VP8, and a container based on RIFF. Webmasters, web developers and browser developers can use WebP to compress, archive and distribute digital images more efficiently...

Factual-Rules-Generator - An Open Source Project Which Aims To Generate YARA Rules About Installed Software From A Machine

Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system. The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find installed software in a time...

Experts Uncover Campaign Stealing Cryptocurrency from Android and iPhone Users

Researchers have blown the lid off a sophisticated malicious scheme primarily targeting Chinese users via copycat apps on Android and iOS that mimic legitimate digital wallet services to siphon cryptocurrency funds. "These malicious apps were able to steal victims' secret seed phrases by...

CVE-2022-22995 Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code...

Western Digital My Cloud 后置链接漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A backlink vulnerability exists in Western Digital My Cloud OS 5 due to insufficient file validation during file uploads in the native language combination provided by SMB and AFP in its default configuration. A...

Western Digital My Cloud Multiple Products 5.0 < 5.21.104 Samba Vulnerability (WDC-22006)

Multiple Western Digital My Cloud products are prone to a vulnerability in Samba. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

Digital Bazaar Forge Data Forgery Issue Vulnerability

Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and network-intensive Web applications from Digital Bazaar, Inc. digitalbazaar Forge versions prior to 1.3.0 are vulnerable to a data forgery issue that originates from RSA PK...

Digital Bazaar Forge Data Forgery Issue Vulnerability (CNVD-2022-22656)

Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and network-intensive Web applications from Digital Bazaar, Inc. A data forgery issue vulnerability exists in versions prior to Digital Bazaar Forge 1.3.0, which originated in...

SUSE SLED15 / SLES15 Security Update : libreoffice (SUSE-SU-2022:0886-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0886-1 advisory. - LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no...

bouncycastle: Timing issue within the EC math library

A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures...

Improper Signature Verification

node-forge uses improper signature verification. Leniency in checking the digest algorithm structure allows remote attackers to specifically craft a structure that steals padding bytes and uses unchecked portion of the PKCS1 encoded message to forge a signature when a low public exponent is being...

Certain HP Print Products, Digital Sending Products - Potential remote code execution and buffer overflow

Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicast Name Resolution or LLMNR. Update your printer firmware...

PT-2022-15768

Name of the Vulnerable Software and Affected Versions Western Digital EdgeRover versions prior to 1.5.1-594 Description A critical error has been discovered in Western Digital's EdgeRover desktop application, which poses a threat of privilege escalation in Windows and macOS, potentially allowing...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2020-2773)

Summary Two XML Digital Signature APIs implemented in the XMLDSigRI provider throw unexpected Exception types. An attacker could exploit this to inflict a DoS. The fix ensures that all Exceptions thrown from these APIs are wrapped in instances of javax.xml.crypto.MarshalException. Vulnerability...

Himalaya Exchange Creates a New Digital Financial System

The Himalaya Exchange offers a new cryptocurrency that is designed to be resistant to extreme price volatility. A key aim for the company is to provide a revolutionary financial solution for the new digital age. Akamai is delighted that this hugely innovative company has chosen us to deliver a...