CVE-2024-45690 Moodle: idor when deleting oauth2 linked accounts

A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks

A new China-linked cyber espionage group has been attributed as behind a series of targeted cyber attacks targeting telecommunications entities in South Asia and Africa since at least 2020 with the goal of enabling intelligence collection. Cybersecurity company CrowdStrike is tracking the adversa...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the need to perform additional checks to ensure that users can onl...

CVE-2024-50520

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Peter J. Herrel Ancient World Linked Data ancient-world-linked-data-for-wordpress allows DOM-Based XSS.This issue affects Ancient World Linked Data: from n/a through = 0.2.1...

CVE-2024-50520 WordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Peter J. Herrel Ancient World Linked Data ancient-world-linked-data-for-wordpress allows DOM-Based XSS.This issue affects Ancient World Linked Data: from n/a through = 0.2.1...

CVE-2024-50520 WordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Peter J. Herrel Ancient World Linked Data ancient-world-linked-data-for-wordpress allows DOM-Based XSS.This issue affects Ancient World Linked Data: from n/a through = 0.2.1...

CVE-2024-50520

CVE-2024-50520 relates to the WordPress plugin “Ancient World Linked Data” (up to version 0.2.1). The issue is a DOM-based Cross-Site Scripting (XSS) caused by improper input neutralization during page generation, enabling script execution in the context of the affected site. Affected software: A...

WordPress plugin Ancient World Linked Data 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

kernel: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink

In Linux kernel net/mlx5e, for SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list...

Malicious code in feature-preserve-portrait-editing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 655ca5fa8c26583d141a0d6f86c0bca2e156cbad062d86ff11ec6827d2ac9cf7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in type-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d68be7ebeb4e06c6e29be15274785ff085ea469d680f831c9d40a4dc3b54e8c A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in controlnot-aux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a99770ef01fb53c863387ed64967ab6ed42be0cf7c901573dcd472db6ae51091 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in kera-preprocess (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6eb322e12f02f6acf94ad19bc2b1c261a2753e3bc4dd74a82a63e31d73e5d9bd A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in openfermionpyscanf (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 eb5fef6cf1c79b7e945198aa689490c004a9b1c400642cece5597b6b7b02bf71 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in @isfe-common/testing-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4203c75b7ee03f443c2944645689ffff3aefae76e13ac2f7be00545b63c27664 The OpenSSF Package Analysis project identified '@isfe-common/testing-constants' @ 9.2.9 npm as malicious. It is considered malicious because: -...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which originates in the bpf module, where an out-of-bounds read problem exists for sockmap linked file descriptors, and is...

WordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Zlrqh Patchstack Alliance in WordPress Plugin Ancient World Linked Data versions = 0.2.1...

WordPress Ancient World Linked Data Plugin <= 0.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Ancient World Linked Data Type Plugin Vulnerable versions = 0.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50520 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1c1d98c6a43b Credits Zlrqh Required privilege...

CVE-2024-50083 tcp: fix mptcp DSS corruption due to large pmtu xmit

In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: requestsocksubflowv4: Possible SYN flooding on port :::20002. Sending cookies. ------------ cut here ------------ WARNING:...

CVE-2024-49370 Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing

Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.1...