ProfileGrid < 5.5.3 - Group Owner+ Unauthorized Data Modification

Description The plugin does not adequately check capabilities on the 'editgroup' handler, enabling authenticated users with group ownership to improperly update group options, including the 'associaterole' parameter, which sets the member's role...

WordPress WP Group Promoter Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Group Promoter Type Plugin Vulnerable versions = 1.0.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 308d9974dbb0 Credits Rafie Muhammad Patchstack Requir...

PT-2023-25800 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: ProfileGrid plugin for WordPress versions up to, and including, 5.5.2 Description: The issue is related to a missing capability check on the 'edit group' handler, allowing authenticated attackers with group ownership to update group options,...

WordPress WUPO Group Attributes for WooCommerce Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)

Software WUPO Group Attributes for WooCommerce Type Plugin Vulnerable versions = 2.3.2 Fixed in 2.3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 510f0d97de42 Credits Rafie...

CVE-2023-35070

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VegaGroup Web Collection allows SQL Injection. This issue affects Web Collection: before 31197...

CVE-2023-35070

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197...

From Malvertising to Ransomware: A ThreatDown webinar recap

Our recent webinar From Malvertising to Ransomware highlight the clear connection between malvertising--the practice of embedding malicious code within legitimate online advertisements--and the epidemic of ransomware attacks affecting businesses globally. Presented by Mark Stockley, security...

New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products

SonicWall on Wednesday urged customers of Global Management System GMS firewall management and Analytics network reporting engine software to apply the latest fixes to secure against a set of 15 security flaws that could be exploited by a threat actor to circumvent authentication and access...

Detecting BPFDoor Backdoor Variants Abusing BPF Filters

An analysis of advanced persistent threat APT group Red Menshen’s different variants of backdoor BPFDoor as it evolves since it was first documented in 2021...

Microsoft Releases Patches for 132 Vulnerabilities, Including 6 Under Active Attack

Microsoft on Tuesday released updates to address a total of 132 new security flaws spanning its software, including six zero-day flaws that it said have been actively exploited in the wild. Of the 132 vulnerabilities, nine are rated Critical, 122 are rated Important in severity, and one has been...

July 11, 2023—KB5028169 (OS Build 14393.6085) - EXPIRED

None None...

CVE-2023-37191

A stored cross-site scripting XSS vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters...

CVE-2023-37191

A stored cross-site scripting XSS vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters...

Malicious code in btc-api-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f59f6e40fe31bd4d5d4aa5da8bc0d032e2bbff9166104dc707c2987f953a5d93 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in kraken-prices (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4a67a11785828e7b3f7489127f8e07868a2e871b01726d0ddd2142345f94bb96 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-1550 Malicious code in btc-api-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f59f6e40fe31bd4d5d4aa5da8bc0d032e2bbff9166104dc707c2987f953a5d93 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

SmarterTools SmarterMail Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution', 'Description' = %q This module exploits a...

CVE-2023-36884

Windows Search Remote Code Execution Vulnerability Recent assessments: cbeek-r7 at August 24, 2023 1:46pm UTC reported: CVE-2023-36884 is a fixed vulnerability that permitted remote code execution. Attackers could manipulate Microsoft Office files to bypass the Mark of the Web MoTW security...

Issabel PBX 跨站请求伪造漏洞

Issabel PBX is a software application. A free and open source software that allows you to build communication tools for your organization. A cross-site request forgery vulnerability exists in Issabel PBX version v.4.0.0-6, which originates from a vulnerability that allows remote attackers to caus...

MAL-2023-1558 Malicious code in kraken-prices (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4a67a11785828e7b3f7489127f8e07868a2e871b01726d0ddd2142345f94bb96 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...