UBUNTU-CVE-2024-42010

modcssstyles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets CSS token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information...

Kazakh Organizations Targeted by 'Bloody Wolf' Cyber Attacks

Organizations in Kazakhstan are the target of a threat activity cluster dubbed Bloody Wolf that delivers a commodity malware called STRRAT aka Strigoi Master. "The program selling for as little as $80 on underground resources allows the adversaries to take control of corporate computers and hijac...

CVE-2024-42009

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php...

CVE-2024-6477

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...

Cybercriminals Abusing Cloudflare Tunnels to Evade Detection and Spread Malware

Cybersecurity companies are warning about an uptick in the abuse of Clouflare's TryCloudflare free service for malware delivery. The activity, documented by both eSentire and Proofpoint, entails the use of TryCloudflare to create a rate-limited tunnel that acts as a conduit to relay traffic from ...

AZL-47367 CVE-2024-6923 affecting package python3 for versions less than 3.12.3-3

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from a lack of output cleanup and emails that could conta...

PT-2024-29661 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: Zitadel versions prior to 2.52.3 Zitadel versions prior to 2.53.9 Zitadel versions prior to 2.54.8 Zitadel versions prior to 2.55.5 Zitadel versions prior to 2.56.2 Zitadel versions prior to 2.57.1 Zitadel versions prior to 2.58.1 Description...

CVE-2024-5808

CVE-2024-5808 affects the WP Ajax Contact Form WordPress plugin up to version 2.2.2. The vulnerability is due to missing CSRF protection when deleting emails from the email list, potentially allowing a logged-in admin to be coerced into performing deletion via CSRF. Technical details across conne...

The vulnerability of the Self-Registration component in the IoT Apache StreamPipes toolset allows a attacker to disrupt the user management process of StreamPipes.

The vulnerability of the Self-Registration component in the IoT Apache StreamPipes toolkit is related to synchronization errors when using a common resource. This vulnerability can allow a malicious actor to manipulate the StreamPipes user management process by creating multiple users with the sa...

CVE-2024-37522

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1...

CVE-2024-37522 WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1...

CVE-2024-37522 WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1...

CVE-2024-37522

CVE-2024-37522 affects the WordPress plugin CC & BCC for Woocommerce Order Emails. The vulnerability is a Stored Cross-Site Scripting (XSS) issue due to improper handling during web page generation. Affected versions are 1.4.1 and earlier; at the time of the provided data, remediation for this CV...

PT-2024-27627 · Woocommerce · Cc & Bcc For Woocommerce Order Emails

Name of the Vulnerable Software and Affected Versions: CC & BCC for Woocommerce Order Emails versions 1.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, which means...

The vulnerabilities of the content scanning and message filtering functions of the Cisco Secure Email Gateway allow attackers to enhance their privileges.

The vulnerability of content scanning and message filtering functions of the Cisco Secure Email Gateway relates to incorrect restrictions on the path name to the directory. Exploiting this vulnerability can allow a malicious actor to enhance their privileges, modify the device configuration,...

PYSEC-2024-172

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache StreamPipes in user self-registration.This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and...

PT-2024-5227 · Apache · Apache Streampipes

Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions through 0.93.0 Description: A Time-of-check Time-of-use TOCTOU Race Condition issue exists in the user self-registration component of Apache StreamPipes. This allows an attacker to potentially create multiple...

New Data-Stealing Poco RAT Campaign Targeting Spanish Speakers

New Poco RAT Malware Targets Spanish Speakers Through Emails! Disguised as financial documents, Poco RAT steals your info…...

CVE-2024-6024

The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack...