CVE-2024-22144

The CVE-2024-22144 entry relates to the WordPress plugin “Anti-Malware Security and Brute-Force Firewall” ≤ 4.21.96, where an improper control of code generation enables unauthenticated code execution (RCE) via a predictable nonce/brute-force approach. Affected component: the plugin’s nonce/autho...

WordPress plugin Anti-Malware Security and Brute-Force Firewall 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...

RHEL 6 / 7 : openstack-neutron (RHSA-2015:1909)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1909 advisory. OpenStack Networking neutron is a pluggable, scalable, and API-driven system that provisions networking services to virtual machines. Its main...

python-aiohttp: HTTP request smuggling via llhttp HTTP request parser

A flaw was found in aio-libs aiohttp, where it is vulnerable to HTTP request smuggling, caused by a flaw in the aiohttp.web.Application. By sending a specially crafted HTTPS request, an attacker can poison the web cache, bypass web application firewall protection, and conduct Cross-site scripting...

VulnCheck KEV: CVE-2024-40766

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash...

ToddyCat Hacker Group Uses Advanced Tools for Industrial-Scale Data Theft

The threat actor known as ToddyCat has been observed using a wide range of tools to retain access to compromised environments and steal valuable data. Russian cybersecurity firm Kaspersky characterized the adversary as relying on various programs to harvest data on an "industrial scale" from...

Wallarm’s Open Source API Firewall debuts at Blackhat Asia 2024 – Introduces Key New Features & Functionalities

Wallarm introduced its ongoing Open Source API Firewall project to the world at the recently concluded Blackhat Asia 2024 conference in Singapore. The open-source API Firewall by Wallarm is a free, lightweight API Firewall designed to protect REST and GraphQL API endpoints across cloud-native...

TOTOLINK N300RT Port Forwarding Function Cross-Site Scripting Vulnerability

The TOTOLINK N300RT is a wireless router designed for home and small business users. The TOTOLINK N300RT suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data by the Port Forwarding feature on the Firewall page, whic...

TOTOLINK N300RT IP/Port Filtering Feature Cross-Site Scripting Vulnerability

The TOTOLINK N300RT is a wireless router designed for home and small business users. The TOTOLINK N300RT suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data by the IP/Port Filtering feature of the Firewall page, an...

TOTOLINK N300RT MAC Filtering Function Cross-Site Scripting Vulnerability

The TOTOLINK N300RT is a wireless router designed for home and small business users. The TOTOLINK N300RT suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the MAC Filtering function on the Firewall page, for whi...

The vulnerability of the Routing Engine module in Juniper Networks Junos OS networking devices of the EX4300 series allows a attacker to compromise the integrity of protected information.

The vulnerability of the Routing Engine RE module in Juniper Networks’ Junos OS networking devices of the EX4300 series is related to the incorrect implementation of the sequence of actions when using a firewall filter for IPv6 packet reception. Exploiting this vulnerability can allow an attacker...

Mitsubishi Electric MELSEC iQ-F Series Insufficient Resource Pool (CVE-2023-7033)

Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote attacker to cause a temporary Denial of Service condition for a certain period of time in Ethernet communication of the products by performing TCP SYN...

CVE-2024-32334

TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting XSS vulnerability in IP/Port Filtering under the Firewall Page...

CVE-2024-32334

TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting XSS vulnerability in IP/Port Filtering under the Firewall Page...

CVE-2024-32327

TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting XSS vulnerability in Port Forwarding under the Firewall Page...

CVE-2024-32333

TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting XSS vulnerability in MAC Filtering under the Firewall Page...

CVE-2024-32327

TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting XSS vulnerability in Port Forwarding under the Firewall Page...

CVE-2024-32333

TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting XSS vulnerability in MAC Filtering under the Firewall Page...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

PAN-OS CVE-2024-3400 Check Overview FOR INTERNAL USE ON...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 8, 2024 to April 14, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 219 vulnerabilities disclosed in 209 WordPres...