750 matches found
ChatGPT-Written Malware
I dont know how much of a thing this will end up being, but we are seeing ChatGPT-written malware in the wild. …within a few weeks of ChatGPT going live, participants in cybercrime forums--some with little or no coding experience--were using it to write software and emails that could be used fo...
Design/Logic Flaw
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations to vote in certain situations...
CVE-2022-1581
CVE-2022-1581 affects the WordPress plugin WP-Polls prior to version 2.76.0. The vulnerability arises because the plugin prioritizes the visitor’s IP taken from certain HTTP headers over PHP’s REMOTE_ADDR, enabling bypass of IP-based voting restrictions in certain scenarios. According to connecte...
GHSA-99R3-XMMQ-7Q7G eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
GHSA-8H83-CHH2-FCHP eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
GHSA-446Q-XXG5-3VHH eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
GHSA-G6JC-XRC3-4WWQ Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
GHSA-394J-X37R-2Q27 Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
PT-2022-28186 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
PT-2022-28268 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
Why Is Snapshot Scanning Not Enough?
As new scanning technologies are released, their supposed superiority is touted over the others. The problem is, however, that there is no best scanning technology, all of them have strengths and limitations. If recent claims from several vendors are believed, a “best” scanning method called...
8 KB is not enough: why WAFs can’t protect APIs
WAFs were a top-notch security instrument a decade ago, but now they are not. They fail to protect APIs. Meanwhile, the number of API-specific vulnerabilities grew more than twofold in 2022. According to a report by Wallarm, many such vulnerabilities have critical severity, and 33% are immediatel...
In-Depth Look Into Data-Driven Science Behind Qualys TruRisk
Vulnerability Management is a foundational component of any cybersecurity program for the implementation of appropriate security controls and the management of cyber risk. Earlier this year Qualys introduced the latest iteration of its vulnerability management product VMDR 2.0 with TruRisk which...
Why Organisations Need Both EDR and NDR for Complete Network Protection
Endpoint devices like desktops, laptops, and mobile phones enable users to connect to enterprise networks and use their resources for their day-to-day work. However, they also expand the attack surface and make the organisation vulnerable to malicious cyberattacks and data breaches. Why Modern...
CVE-2022-1613
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations in certain situations...
Cross site scripting
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations in certain situations...
CVE-2022-1613
The CVE-2022-1613 issue affects the Restricted Site Access WordPress plugin (versions before 7.3.2). The root cause is the plugin prioritizing certain HTTP headers over PHP’s REMOTE_ADDR when obtaining a visitor IP, enabling bypass of IP-based restrictions in some scenarios. The vulnerability is ...