CVE-2021-42970

Cross Site Scripting XSS vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter...

CVE-2021-42970

CXUUCMS v3 is affected by a Cross Site Scripting (XSS) vulnerability via the imgurl field in the /feedback/post/ content parameter. The root cause is unsafely handled user input in the imgurl parameter, enabling script injection visible to other users. According to the cited references, this is a...

CVE-2021-42970: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter...

Google Releases Security Updates for Chrome

Google has released Chrome version 99.0.4844.84 for Windows, Mac, and Linux. This version addresses a vulnerability that an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review the Chrome Release Note and apply the necessary updates. Thi...

Oh365UserFinder - Python3 O365 User Enumeration Tool

Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify false positives based on...

Google Releases Security Updates for Chrome

Google has released Chrome version 99.0.4844.74 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review the Chrome Release Note and apply the necessary updates. Thi...

Apple Releases Security Updates for Multiple Products

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Apple security page and apply the necessary updates. This...

WordPress Simple Feature Requests Free – User Feedback Board plugin < 2.2.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Simple Feature Requests Free – User Feedback Board plugin versions 2.2.4. Solution Update the WordPress Simple Feature Requests Free – User Feedback Board plugin to the latest available version at leas...

WordPress "FeedbackScout: The easiest way to collect, prioritise, manage and track customer feedback." plugin <= 1.9.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "FeedbackScout: The easiest way to collect, prioritise, manage and track customer feedback." plugin versions = 1.9.3. Solution No patched version available...

WordPress Get feedback from visitors – WP Feedback Suite Plugin plugin <= 1.0.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Get feedback from visitors – WP Feedback Suite Plugin plugin versions = 1.0.5. Solution No patched version available...

WordPress Get feedback from visitors – WP Feedback Suite Plugin plugin <= 1.0.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Get feedback from visitors – WP Feedback Suite Plugin plugin versions = 1.0.5. Solution No patched version available...

Trellix “Catmen Sanfrancisco” Capture the Flag Results!

Trellix “Catmen Sanfrancisco” Capture the Flag Results! By Trellix · February 28, 2022 This story was written by Steve Povolny. And just like that, it’s all over! Our annual Capture the Flag contest expired at 11:59pm PST, on February 25th. We wanted to take a moment to thank all of our...

Mozilla Releases Security Update for Mozilla VPN

Mozilla has released a security update to address a vulnerability in Mozilla VPN. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Mozilla Foundation Security Advisory 2022-08 and make the necessary update. This...

Review your security vulnerabilities in GitHub with code scanning alerts

Today, for GitHub repositories, our SAST analysis provides fast, precise security feedback directly inside your pull requests. You instantly know how many vulnerabilities are detected and, until now, you would systematically go to SonarCloud to start investigating. Not anymore. From this point...

New Sandworm Malware Cyclops Blink Replaces VPNFilter

The United Kingdom’s National Cyber Security Centre, CISA, the National Security Agency, and the Federal Bureau of Investigation have released a joint Cybersecurity Advisory CSA reporting that the malicious cyber actor known as Sandworm or Voodoo Bear is using new malware, referred to as Cyclops...

Kill Cloud Risk: Get Everybody to Stop Fighting Over App Security - Podcast

Brought to you by Uptycs. Underwriters of Threatpost podcasts do not assert any editorial control over content. Applications are cybercriminals’ favorite ways to crack open targeted organizations. Yet no single team or process can assure the rollout of safe cloud applications. From code design to...

Mozilla Releases Security Update for Thunderbird  

Mozilla has released a security update to address a vulnerability in Thunderbird. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review the Mozilla security advisory for Thunderbird 91.6.1 and make the necessary...

FBI and USSS Release Advisory on BlackByte Ransomware

The Federal Bureau of Investigation FBI and the United States Secret Service USSS have released a joint Cybersecurity Advisory CSA identifying indicators of compromise associated with BlackByte ransomware. BlackByte is a Ransomware-as-a-Service group that encrypts files on compromised Windows hos...

Adobe Releases Security Updates for Commerce and Magento Open Source

Adobe has released security updates to address a vulnerability affecting Adobe Commerce and Magento Open Source. An attacker could exploit this vulnerability to take control of an affected system. This vulnerability has been detected in exploits in the wild. CISA encourages users and administrato...