Multiple vulnerabilities in WordPress Plugin "Survey Maker"

Overview WordPress Plugin "Survey Maker" provided by AYS Pro Plugins contains multiple vulnerabilities listed below. Stored cross-site scripting CWE-79 - CVE-2023-34423 Insufficient verification of data authenticity CWE-345 - CVE-2023-35764 Atsuya Yoda of GMO Cybersecurity by Ierae, Inc. reported...

PT-2024-2475 · Okta · Okta Verify For Windows

Name of the Vulnerable Software and Affected Versions: Okta Verify for Windows affected versions not specified Description: The issue is related to the auto-update service of Okta Verify for Windows, which is vulnerable to two flaws that can be combined to execute arbitrary code. This could allow...

USN-6710-1 firefox vulnerabilities

Manfred Paul discovered that Firefox did not properly perform bounds checking during range analysis, leading to an out-of-bounds write vulnerability. A attacker could use this to cause a denial of service, or execute arbitrary code. CVE-2024-29943 Manfred Paul discovered that Firefox incorrectly...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment, related to deficiencies in authorization procedures, allows unauthorized users to gain access to protected information.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in authorization procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws

A China-linked threat cluster leveraged security flaws in Connectwise ScreenConnect and F5 BIG-IP software to deliver custom malware capable of delivering additional backdoors on compromised Linux hosts as part of an "aggressive" campaign. Google-owned Mandiant is tracking the activity under its...

Massive Sign1 Campaign Infects 39,000+ WordPress Sites with Scam Redirects

A massive malware campaign dubbed Sign1 has compromised over 39,000 WordPress sites in the last six months, using malicious JavaScript injections to redirect users to scam sites. The most recent variant of the malware is estimated to have infected no less than 2,500 sites over the past two months...

The vulnerability of the deployment and management software for Azure Kubernetes Service Confidential Containers relates to deficiencies in access control, allowing attackers to escalate their privileges.

The vulnerability of the Azure Kubernetes Service Confidential Containers’ deployment and management software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Windows Standards-Based Storage Management service in Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the Windows Standards-Based Storage Management service in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures using specially created data...

The vulnerability of the Windows Composite Image File System (CimFS) component in operating systems allows attackers to enhance their privileges.

The vulnerability of the Windows Composite Image File System CimFS component in operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the HikCentral Professional security management system, related to deficiencies in access control, allows attackers to increase their privileges.

The vulnerability of the HikCentral Professional security management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of SCSI device handlers in Windows operating systems allows attackers to increase their privileges.

The vulnerability of SCSI device handlers in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Telerik Report Server’s reporting control software lies in its deserialization mechanism flaws, which allow attackers to execute arbitrary code.

The vulnerability of the Telerik Report Server reporting control panel is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

Cybersecurity researchers have shed light on a tool referred to as AndroxGh0st that's used to target Laravel applications and steal sensitive data. "It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twilio," Juniper Threat Labs...

GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws

GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide targeted recommendations in an effort to avoid introducing new security issues. "Powered by GitHub Copilot and CodeQL, code scanning autofi...

Atlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo Bug

Atlassian has released patches for more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could be exploited without requiring user interaction. Tracked as CVE-2024-1597, the vulnerability carries a CVSS score of 10.0, indicating maximum severity...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2024-1399)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6702-2 linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly handle return values in certain error conditions. A local attacker could use this to cause a denial of service system crash. CVE-2023-23000 It was discovered that the ARM Mali Display Processor...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: cadvisor, melange, buildkitd, kubescape, trivy, grype, tkn, wolfictl, syft, conftest, docker-compose, up, ko, crossplane, zot, aactl, ctop, kaniko, dagger, kargo, cilium-cli, spire-server, buf...

USN-6686-4 linux-kvm vulnerabilities

It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly handle certain error conditions during device registration. A local attacker could possibly use this to cause a denial of service system crash. CVE-2023-22995 It was discovered that a race...

Ubuntu 22.04 LTS / 23.10 : Linux kernel (AWS) vulnerabilities (USN-6680-3)

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6680-3 advisory. discovered that the NFC Controller Interface NCI implementation in the Linux kernel did not properly handle certain memory allocation failure...