1069 matches found
Silverstripe HtmlEditor embed url sanitisation
"Add from URL" doesn't clearly sanitise URL server side HtmlEditorFieldToolbar has an action HtmlEditorFieldToolbarviewfile, which gets called by the CMS when adding a media "from a URL" i.e. via oembed. This action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL...
New Windows 11 features strengthen security to address evolving cyberthreat landscape
Ahead of the Microsoft Build 2024 conference, we announced a new class of Windows computers, Copilot+ PC. Alongside this exciting new class of PCs, we are introducing important security features and updates that make Windows 11 more secure for users and organizations and give developers the tools...
Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail
A "multi-faceted campaign" has been observed abusing legitimate services like GitHub and FileZilla to deliver an array of stealer malware and banking trojans such as Atomic aka AMOS, Vidar, Lumma aka LummaC2, and Octo by impersonating credible software like 1Password, Bartender 5, and Pixelmator...
CVE-2023-51546
CVE-2023-51546 is an authority-listed vulnerability in the WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (affected: up to version 4.2.1). The issue stems from Improper Privilege Management that enables Privilege Escalation . The vulnerability affects...
CVE-2023-47682
CVE-2023-47682 affects the WordPress WP User Frontend plugin (versions ≤3.6.5). The issue is improper privilege management that allows authenticated users (author level and above) to escalate privileges, potentially enabling admin-level access via the registration_form function. The vulnerability...
CVE-2023-41954
The ProfilePress Membership Team plugin for WordPress is affected by an Improper Privilege Management vulnerability in versions through 4.13.1 . This flaw allows for unauthenticated limited privilege escalation , where an attacker can gain unauthorized access to restricted features or data. The i...
CVE-2023-41665
CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP
CVE-2024-27281
A vulnerability exists in RDoc versions 6.3.3 through 6.6.2 , distributed in Ruby 3.x through 3.3.0 . The root cause is a lack of restrictions on classes that can be restored when parsing .rdoc_options as a YAML file , which can lead to object injection and remote code execution (RCE) . This impa...
CVE-2024-23712
CVE-2024-23712 affects Android’s AppOpsService.java. It describes a potential DoS by saturating /data/system/appops_accesses.xml due to resource exhaustion. Exploitation is local with no privileges and no user interaction required. Android bulletin context indicates fixes in patch levels 2024-04-...
Feds Unmask LockBit Ransomware Leader as Dmitry Yuryevich Khoroshev
By Waqas In a major blow to ransomware, international law enforcement has unmasked Dmitry Yuryevich Khoroshev, the leader of LockBit ransomware. Learn about the takedown, sanctions imposed, and the future of LockBit in a post-Khoroshev era. This is a post from HackRead.com Read the original post:...
Microsoft announces the 2024 Microsoft Security Excellence Awards winners
At this years Microsoft Security Excellence Awards, we took a journey through the evolution of cybersecurity from the 1950s to today. While this event theme celebrated the significant technological advancements that have shaped each decade, the main focus was on the Microsoft Intelligent Security...
A Checklist for What Every Online Coding Class for Kids Needs
By Uzair Amir Is your coding class engaging and effective? Learn what makes the best online coding classes for kids fun, effective, and future-proof! This is a post from HackRead.com Read the original post: A Checklist for What Every Online Coding Class for Kids Needs...
Security above all else—expanding Microsoft’s Secure Future Initiative
Last November, we launched the Secure Future Initiative SFI to prepare for the increasing scale and high stakes of cyberattacks. SFI brings together every part of Microsoft to advance cybersecurity protection across our company and products. Since then, the threat landscape has continued to rapid...
Using Our Environmental Management System to Create a Sustainable Future
...
RHEL 8 : Satellite 6.13.3 Async Security Update (Important) (RHSA-2023:4466)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4466 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...
RHEL 8 : RHUI 4.4.0 - Security Fixes, Bug Fixes, and Enhancements Update (Moderate) (RHSA-2023:2101)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2101 advisory. Red Hat Update Infrastructure RHUI offers a highly scalable, highly redundant framework that enables you to manage repositories and content...
CVE-2023-5675
CVE-2023-5675 affects Quarkus RestEasy Classic/Reactive JAX-RS endpoints where methods are declared in abstract classes or altered by extensions via annotation processors; authorization may not be enforced when quarkus.security.jaxrs.deny-unannotated-endpoints or quarkus.security.jaxrs.default-ro...
CVE-2023-47774
CVE-2023-47774 affects Automattic Jetpack. Root cause: improper restriction of rendered UI layers/frames enables clickjacking via iframes. Affected product: Jetpack plugin for WordPress (versions before 12.7). Impact: potential user interactions being manipulated by an attacker through a maliciou...
Texting Secrets: How Messenger Apps Guard Your Chats
By Uzair Amir Worried about prying eyes? We explain how messenger apps keep your chats confidential with features like encryption & multi-factor authentication. Learn about security risks & emerging technologies for a safer digital future. This is a post from HackRead.com Read the original post:...