CVE-2021-4401 Style Kits <= 1.8.0 - Cross-Site Request Forgery Bypass

The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the updatepostsstylekit function. This makes it possible for unauthenticated attackers to update style kits for posts vi...

CVE-2021-4401

The CVE pertains to the WordPress Style Kits plugin, affected versions up to and including 1.8.0. The root cause is missing or incorrect nonce validation in the update_posts_stylekit() function, enabling Cross‑Site Request Forgery (CSRF). This allows unauthenticated attackers to update style kits...

WordPress Plugin Style Kits 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-12513 · WordPress · Style Kits

Name of the Vulnerable Software and Affected Versions: The Style Kits plugin for WordPress versions up to, and including, 1.8.0 Description: The issue is due to missing or incorrect nonce validation on the update posts stylekit function, making it possible for unauthenticated attackers to update...

CVE-2021-4401: Cross-Site Request Forgery (CSRF)

The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the updatepostsstylekit function. This makes it possible for unauthenticated attackers to update style kits for posts vi...

Threat Roundup for June 2 to June 9

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between June 2 and June 9. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft

" CVE-2021-31956" WIP PoC code for CVE-2021-31956 in preparat...

New Phishing-as-a-Service Platform Lets Cybercriminals Generate Convincing Phishing Pages

A new phishing-as-a-service PhaaS or PaaS platform named Greatness has been leveraged by cybercriminals to target business users of the Microsoft 365 cloud service since at least mid-2022, effectively lowering the bar to entry for phishing attacks. "Greatness, for now, is only focused on Microsof...

Threat Roundup for May 5 to May 12

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 5 and May 12. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

CVE-2022-34147

Improper input validation in BIOS firmware for some IntelR NUC 9 Extreme Laptop Kits, IntelR NUC Performance Kits, IntelR NUC Performance Mini PC, IntelR NUC 8 Compute Element, IntelR NUC Pro Kit, IntelR NUC Pro Board, and IntelR NUC Compute Element may allow a privileged user to potentially enab...

CVE-2022-32577

Improper input validation in BIOS Firmware for some IntelR NUC Kits before version PY0081 may allow a privileged user to potentially enable information disclosure or denial of service via local access...

CVE-2022-32577

Improper input validation in BIOS Firmware for some IntelR NUC Kits before version PY0081 may allow a privileged user to potentially enable information disclosure or denial of service via local access...

CVE-2022-32577

CVE-2022-32577 affects Intel NUC BIOS firmware prior to PY0081. The issue is improper input validation in BIOS firmware that may allow a privileged local attacker to cause information disclosure or denial of service. The impact is noted as Confidentiality High and Availability High on affected co...

CVE-2022-32577

Improper input validation in BIOS Firmware for some IntelR NUC Kits before version PY0081 may allow a privileged user to potentially enable information disclosure or denial of service via local access...

PT-2023-13082 · Intel · Intel Nuc Kit

Name of the Vulnerable Software and Affected Versions: IntelR NUC Kits versions prior to PY0081 Description: The issue is related to improper input validation in BIOS Firmware, which may allow a privileged user to potentially enable information disclosure or denial of service via local access...

CVE-2022-32577: Improper Input Validation

Improper input validation in BIOS Firmware for some IntelR NUC Kits before version PY0081 may allow a privileged user to potentially enable information disclosure or denial of service via local access...

Researchers Uncover Thriving Phishing Kit Market on Telegram Channels

In yet another sign that Telegram is increasingly becoming a thriving hub for cybercrime, researchers have found that threat actors are using the messaging platform to peddle phishing kits and help set up phishing campaigns. "To promote their 'goods,' phishers create Telegram channels through whi...

The Telegram phishing market

Telegram has been gaining popularity with users around the world year by year. Common users are not the only ones who have recognized the messaging apps handy features — cybercrooks have already made it a branch of the dark web, their Telegram activity soaring since late 2021. The service is...

Threat Round up for February 10 to February 17

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Feb. 10 and Feb. 17. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

New Ransomware Variants Created Using Leaked Conti Source Code

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The leaked source code of the Conti ransomware has been used to create new strains of the ransomware. These new strains include Putin Team, ScareCrow, BlueSky, and Meow ransomware are being distributed...