Defeating Future Threats Starts Today

Welcome to this week's edition of the Threat Source newsletter. You don't need me to tell you that security is constantly changing and that more change is on its way. The enthusiastic adoption of new AI systems will inevitably lead to more demands on cybersecurity teams. Not only will these syste...

CVE-2018-9373

CVE-2018-9373 is a vulnerability in the Mediatek WLAN TDLS path (TdlsexRxFrameHandle) of the MTK WLAN driver. The issue is an out-of-bounds write caused by a missing bounds check, enabling remote escalation of privilege with no additional privileges and no user interaction. Documents consistently...

CVE-2024-56949

An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2024-55931

Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin...

CVE-2024-55931

Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin...

Third Interdisciplinary Workshop on Reimagining Democracy (IWORD 2024)

Last month, Henry Farrell and I convened the Third Interdisciplinary Workshop on Reimagining Democracy IWORD 2024 at Johns Hopkins University's Bloomberg Center in Washington DC. This is a small, invitational workshop on the future of democracy. As with the previous two workshops, the goal was to...

PT-2025-3159

Name of the Vulnerable Software and Affected Versions Xerox Workplace Suite affected versions not specified Description The issue concerns the storage of tokens in session storage, which may expose them to potential access if a user's session is compromised. A patch for this issue will be include...

UBUNTU-CVE-2024-57931

In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG. This commit ensures that future permissions can be added without interfering with older kernels...

CVE-2023-27539

There is a denial of service vulnerability in the header parsing component of Rack...

CVE-2023-47778

CVE-2023-47778 concerns LuckyWP Scripts Control for WordPress. The vulnerability is a Missing Authorization/Broken Access Control issue in LuckyWP Scripts Control versions

CVE-2023-46632

CVE-2023-46632 : WordPress plugin My Shortcodes

CVE-2023-45275

The CVE-2023-45275 entry refers to a Missing Authorization / Broken Access Control issue in the WordPress Kali Forms plugin (Contact Form builder with drag & drop). Affected versions are Kali Forms through 2.3.28; the vulnerability stems from an access-control weakness that could be exploited by ...

CVE-2020-9211

CVE-2020-9211 refers to an out-of-bounds read/write vulnerability in Huawei smartphones. The issue arises because a module does not sufficiently verify input, enabling denial of service through crafted configuration changes. Affected product: Huawei smartphone software; root cause: inadequate inp...

CVE-2020-9086

Summary: CVE-2020-9086 describes a buffer error vulnerability in some Huawei products where an unauthenticated attacker can trigger a flaw by sending specially crafted UPnP messages to vulnerable devices, due to insufficient input validation. The consequence is a potential service abnormality, wi...

CVE-2022-32144

CVE-2022-32144 concerns Huawei’s Huawei CV81-WDM FW with an Insufficient Input Validation vulnerability. The core issue is input validation failing in Huawei products, enabling potential network-based abuse that could cause service abnormality. CNVD/ CNNVD/PTSecurity references identify Huawei CV...

CVE-2024-54413

Cross-Site Request Forgery CSRF vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through = 0.2.3...

CVE-2024-54413 WordPress Display Future Posts plugin <= 0.2.3 - CSRF to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through = 0.2.3...

CVE-2024-54413 WordPress Display Future Posts plugin <= 0.2.3 - CSRF to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in Stefan Brandt Display Future Posts allows Stored XSS.This issue affects Display Future Posts: from n/a through 0.2.3...

WordPress plugin Display Future Posts 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the...

PT-2024-36301 · Unknown · Display Future Posts

Name of the Vulnerable Software and Affected Versions: Display Future Posts versions n/a through 0.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...