4235 matches found
CVE-2024-52589
Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...
CVE-2024-52589
Discourse CVE-2024-52589 involves an authorization issue where moderators can view the Screened emails list in the admin dashboard and learn users’ emails. Multiple sources flag this as a vulnerability in Discourse with the fix being applied in the latest versions; where upgrade is not possible, ...
CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse
Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...
CVE-2024-52589: Exposure of Sensitive Information to an Unauthorized Actor
Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...
PT-2024-35385
Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version Description Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user...
Discourse 信息泄露漏洞
Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse has an authorization issue vulnerability that stems from improper privilege management of the Filter Email List feature in the...
HubPhish Abuses HubSpot Tools to Target 20,000 European Users for Credential Theft
Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims' Microsoft Azure cloud infrastructure. The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to t...
APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP
The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol RDP configuration files. The activity, which has targeted governments and armed forces, think tanks, academic...
PT-2024-17651
Name of the Vulnerable Software and Affected Versions Peter’s Custom Anti-Spam plugin for WordPress versions up to, and including, 3.2.3 Description The issue is due to missing nonce validation on the cas register post function, making it possible for unauthenticated attackers to blacklist emails...
CVE-2024-12554: Cross-Site Request Forgery (CSRF)
The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on the casregisterpost function. This makes it possible for unauthenticated attackers to blacklist emails via a forged...
Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks
APT group Earth Koshchei, suspected to be sponsored by the SVR, executed a large-scale rogue RDP campaign using spear-phishing emails, red team tools, and sophisticated anonymization techniques to target high-profile sectors...
CVE-2024-54388
Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...
CVE-2024-54388
CVE-2024-54388 is described as a CSRF to stored XSS vulnerability in the WordPress plugin 'Multiple Admin Emails' (vulnerable up to version 1.0). Public connected documents identify this CVE with explicit vulnerability type and affected software, but do not provide concrete exploit details or rem...
CVE-2024-54388 WordPress Multiple Admin Emails plugin <= 1.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...
CVE-2024-54388: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...
WordPress plugin Multiple Admin Emails 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
PT-2024-36274 · Unknown · Phuc Pham Multiple Admin Emails
Name of the Vulnerable Software and Affected Versions: Phuc Pham Multiple Admin Emails versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This affects the multiple admin emails functionality...
CVE-2023-32507
Missing Authorization vulnerability in Mehul Kaklotar Woo Custom Emails woo-custom-emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through = 2.2...