1766 matches found
CVE-2024-5451
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insufficient input sanitization and output escaping on...
Malicious code in icon-reactjs (npm)
This package is considered malicious because it contains code to spam Telegram channels and Whatsapp channels with fake payment confirmations...
MAL-2024-1603 Malicious code in icon-reactjs (npm)
This package is considered malicious because it contains code to spam Telegram channels and Whatsapp channels with fake payment confirmations...
CVE-2024-5612
The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eaellightboxopenbtnicon’ parameter within the Lightbox & Modal widget in all versions up to, and including, 5.8.15 due to insufficient input sanitization and output escaping. This mak...
CVE-2024-5453
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdismissiblenotice and pmwizardupdategroupicon functions in all versions up to, and including, 5.8.6. This makes it possible fo...
CVE-2024-5453
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdismissiblenotice and pmwizardupdategroupicon functions in all versions up to, and including, 5.8.6. This makes it possible fo...
OESA-2024-1632 nautilus security update
It's easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop. Security Fixes: GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename...
OESA-2024-1631 nautilus security update
It's easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop. Security Fixes: GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename...
Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide
The threat actors behind the Windows-based Grandoreiro banking trojan have returned in a global campaign since March 2024 following a law enforcement takedown in January. The large-scale phishing attacks, likely facilitated by other cybercriminals via a malware-as-a-service MaaS model, target ove...
PT-2024-27888 · WordPress · Salient Shortcodes
Name of the Vulnerable Software and Affected Versions: Salient Shortcodes plugin for WordPress versions up to, and including, 1.5.3 Description: The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion via the icon shortcode image attribute. This allows authenticated...
PT-2024-27890 · WordPress · Salient Core
Name of the Vulnerable Software and Affected Versions: Salient Core plugin for WordPress versions up to, and including, 2.0.7 Description: The Salient Core plugin for WordPress is vulnerable to Local File Inclusion via the nectar icon shortcode icon linea attribute. This allows authenticated...
CVE-2024-1993
The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
CVE-2024-1993
CVE-2024-1993 affects the WordPress Icon Widget plugin. Versions up to and including 1.3.0 are vulnerable to Stored XSS via shortcode attributes due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher, enabling an attac...
WordPress plugin Icon Widget 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2024-18481 · WordPress · Icon Widget
Name of the Vulnerable Software and Affected Versions: Icon Widget plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied...
WordPress Icon Widget plugin <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode vulnerability
AuthenticatedContributor+ Stored Cross-Site Scripting via shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Icon Widget versions = 1.3.0...
WordPress Icon Widget Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
Software Icon Widget Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1993 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 931e7c30054e Credits Krzysztof Zając Required...
New Android Trojan 'SoumniBot' Evades Detection with Clever Tricks
A new Android trojan called SoumniBot has been detected in the wild targeting users in South Korea by leveraging weaknesses in the manifest extraction and parsing procedure. The malware is "notable for an unconventional approach to evading analysis and detection, namely obfuscation of the Android...
Mozilla Firefox for iOS Security Bypass Vulnerability
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox for iOS due to an inability to replace the security icon with the mixed content security status if an insecure element is added to a page after...
