SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach

SquareX warns of OAuth attacks targeting Chrome extensions, exposing users to session hijacking and data theft. Secure your browser with proactive BDR solutions...

When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions

News has been making headlines over the weekend of the extensive attack campaign targeting browser extensions and injecting them with malicious code to steal user credentials. Currently, over 25 extensions, with an install base of over two million users, have been found to be compromised, and...

Dozens of Chrome Extensions Hacked, Exposing Millions of Users to Data Theft

A new attack campaign has targeted known Chrome browser extensions, leading to at least 35 extensions being compromised and exposing over 2.6 million users to data exposure and credential theft. The attack targeted publishers of browser extensions on the Chrome Web Store via a phishing campaign a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the admin/auth/menu and /admin/auth/extensions components due to improper user input sanitization. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicio...

DEBIAN-CVE-2024-53228

In the Linux kernel, the following vulnerability has been resolved: riscv: kvm: Fix out-of-bounds array access In kvmriscvvcpusbiinit the entry-extidx can contain an out-of-bound index. This is used as a special marker for the base extensions, that cannot be disabled. However, when traversing the...

Dcat Admin 安全漏洞

Dcat Admin is a backend system builder based on the secondary development of laravel-admin by Jiang Qinghua. A security vulnerability exists in Dcat Admin v2.2.0-beta and v2.2.2-beta, which was discovered to contain a cross-site scripting vulnerability via /admin/auth/menu and...

CVE-2024-11776

The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11776

CVE-2024-11776 affects the PCRecruiter Extensions plugin for WordPress. It is a Stored XSS vulnerability in the plugin’s PCRecruiter shortcode, exploitable by authenticated users with contributor-level access or higher, due to insufficient input sanitization and output escaping in versions up to ...

CVE-2024-11776 PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11776 PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-17250 · WordPress · Pcrecruiter Extensions

Name of the Vulnerable Software and Affected Versions: PCRecruiter Extensions plugin for WordPress versions up to, and including, 1.4.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode due to insufficient input sanitization and output...

WordPress plugin PCRecruiter Extensions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress PCRecruiter Extensions plugin <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin PCRecruiter Extensions versions = 1.4.22...

aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

A flaw was found in the aiohttp package. The Python parser parses newlines in chunk extensions incorrectly, which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed, for example, without the usual C extensions, or...

MAL-2024-11969 Malicious code in docusaurus-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99775db155b8a86158ff592e554afaaa639d5e3c1b467c6e374fbb1925333cbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in docusaurus-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99775db155b8a86158ff592e554afaaa639d5e3c1b467c6e374fbb1925333cbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2024-1734532058 unbound: Fix of 2 CVEs

CVE-2023-50387: Evaluate DNSSEC responses to prevent KeyTrap denial of service issue. - CVE-2023-50868: Fix Closest Encloser Proof aspect to prevent CPU consumption for SHA-1 computations in random subdomain attacks...

The vulnerability of the Trusted Execution Environment (TEE) for the deployment of Intel Trust Domain Extensions (Intel TDX) allows a perpetrator to exploit their privileges by improperly checking input data.

The vulnerability of the Trusted Execution Environment TEE for deploying Intel Trust Domain Extensions Intel TDX lies in improper validation of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges...

The vulnerability of the Trusted Execution Environment (TEE) for the deployment of Intel Trust Domain Extensions (Intel TDX) allows a perpetrator to exploit their privileges by improperly checking input data.

The vulnerability of the Trusted Execution Environment TEE for deploying Intel Trust Domain Extensions virtual machines is related to improper validation of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges...

bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

A flaw was found in bind9. By flooding a DNSSEC resolver with responses coming from a DNSEC-signed zone using NSEC3, an attacker can lead the targeted resolver to a CPU exhaustion, further leading to a Denial of Service on the targeted host. This vulnerability applies only for systems where DNSSE...