Silverstripe HtmlEditor embed url sanitisation

"Add from URL" doesn't clearly sanitise URL server side HtmlEditorFieldToolbar has an action HtmlEditorFieldToolbarviewfile, which gets called by the CMS when adding a media "from a URL" i.e. via oembed. This action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL...

New Windows 11 features strengthen security to address evolving cyberthreat landscape

Ahead of the Microsoft Build 2024 conference, we announced a new class of Windows computers, Copilot+ PC. Alongside this exciting new class of PCs, we are introducing important security features and updates that make Windows 11 more secure for users and organizations and give developers the tools...

Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail

A "multi-faceted campaign" has been observed abusing legitimate services like GitHub and FileZilla to deliver an array of stealer malware and banking trojans such as Atomic aka AMOS, Vidar, Lumma aka LummaC2, and Octo by impersonating credible software like 1Password, Bartender 5, and Pixelmator...

CVE-2023-51546

CVE-2023-51546 is an authority-listed vulnerability in the WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (affected: up to version 4.2.1). The issue stems from Improper Privilege Management that enables Privilege Escalation . The vulnerability affects...

CVE-2023-47682

CVE-2023-47682 affects the WordPress WP User Frontend plugin (versions ≤3.6.5). The issue is improper privilege management that allows authenticated users (author level and above) to escalate privileges, potentially enabling admin-level access via the registration_form function. The vulnerability...

CVE-2023-41954

ProfilePress WordPress plugin

CVE-2023-41665

CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP

CVE-2024-27281

CVE-2024-27281 affects Ruby/RDoc: parsing .rdoc_options as YAML allows object injection and remote code execution due to unrestrained class restoration (and also if a crafted cache is loaded). Affected RDoc versions are 6.3.3–6.6.2; fixed in RDoc 6.6.3.1 (and vendor-specific bumps: Ruby 3.0 users...

CVE-2024-23712

CVE-2024-23712 affects Android’s AppOpsService.java. It describes a potential DoS by saturating /data/system/appops_accesses.xml due to resource exhaustion. Exploitation is local with no privileges and no user interaction required. Android bulletin context indicates fixes in patch levels 2024-04-...

Feds Unmask LockBit Ransomware Leader as Dmitry Yuryevich Khoroshev

By Waqas In a major blow to ransomware, international law enforcement has unmasked Dmitry Yuryevich Khoroshev, the leader of LockBit ransomware. Learn about the takedown, sanctions imposed, and the future of LockBit in a post-Khoroshev era. This is a post from HackRead.com Read the original post:...

Microsoft announces the 2024 Microsoft Security Excellence Awards winners

At this years Microsoft Security Excellence Awards, we took a journey through the evolution of cybersecurity from the 1950s to today. While this event theme celebrated the significant technological advancements that have shaped each decade, the main focus was on the Microsoft Intelligent Security...

A Checklist for What Every Online Coding Class for Kids Needs

By Uzair Amir Is your coding class engaging and effective? Learn what makes the best online coding classes for kids fun, effective, and future-proof! This is a post from HackRead.com Read the original post: A Checklist for What Every Online Coding Class for Kids Needs...

Security above all else—expanding Microsoft’s Secure Future Initiative

Last November, we launched the Secure Future Initiative SFI to prepare for the increasing scale and high stakes of cyberattacks. SFI brings together every part of Microsoft to advance cybersecurity protection across our company and products. Since then, the threat landscape has continued to rapid...

Using Our Environmental Management System to Create a Sustainable Future

...

RHEL 8 : RHUI 4.4.0 - Security Fixes, Bug Fixes, and Enhancements Update (Moderate) (RHSA-2023:2101)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2101 advisory. Red Hat Update Infrastructure RHUI offers a highly scalable, highly redundant framework that enables you to manage repositories and content...

RHEL 8 : Satellite 6.13.3 Async Security Update (Important) (RHSA-2023:4466)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4466 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...

CVE-2023-5675

CVE-2023-5675 affects Quarkus RestEasy Classic/Reactive JAX-RS endpoints where methods are declared in abstract classes or altered by extensions via annotation processors; authorization may not be enforced when quarkus.security.jaxrs.deny-unannotated-endpoints or quarkus.security.jaxrs.default-ro...

CVE-2023-47774

CVE-2023-47774 affects Automattic Jetpack. Root cause: improper restriction of rendered UI layers/frames enables clickjacking via iframes. Affected product: Jetpack plugin for WordPress (versions before 12.7). Impact: potential user interactions being manipulated by an attacker through a maliciou...

Texting Secrets: How Messenger Apps Guard Your Chats

By Uzair Amir Worried about prying eyes? We explain how messenger apps keep your chats confidential with features like encryption & multi-factor authentication. Learn about security risks & emerging technologies for a safer digital future. This is a post from HackRead.com Read the original post:...

CVE-2024-2739

The CVE-2024-2739 entry concerns the WordPress plugin Advanced Search (older than or equal to 1.1.6), which lacks CSRF protections in certain areas. This absence could allow an attacker to coerce logged-in users into performing unintended actions via CSRF. The available connected documents reiter...