8747 matches found
CVE-2024-6310: Cross-Site Request Forgery (CSRF)
The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admininitAAPL' function and missing file type validation in the 'AAPLoptionsvalidate'...
WordPress plugin Advanced AJAX Page Loader security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
GootLoader Malware Still Active, Deploys New Versions for Enhanced Attacks
The malware known as GootLoader continues to be in active use by threat actors looking to deliver additional payloads to compromised hosts. "Updates to the GootLoader payload have resulted in several versions of GootLoader, with GootLoader 3 currently in active use," cybersecurity firm Cybereason...
FakeBat Loader Malware Spreads Widely Through Drive-by Download Attacks
The loader-as-a-service LaaS known as FakeBat has become one of the most widespread loader malware families distributed using the drive-by download technique this year, findings from Sekoia reveal. "FakeBat primarily aims to download and execute the next-stage payload, such as IcedID, Lumma,...
CVE-2024-6441 ORIPA LoaderXML.java deserialization
A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation leads to deserialization. The attack can be launched remotely...
@aofl/cli (>=4.0.0-alpha.0, <=4.0.0-alpha.45), @aofl/html-webpack-purify-internal-css-plugin (>=4.0.0-alpha.22, <=4.0.0-alpha.45) +4 more potentially affected by CVE-2024-38987 via @aofl/cli-lib (4.0.0-alpha.45)
@aofl/cli-lib NPM version 4.0.0-alpha.45 is affected by a known vulnerability. The following packages have a transitive dependency on @aofl/cli-lib and may be impacted: - @aofl/cli =4.0.0-alpha.0, =4.0.0-alpha.22, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.45...
8220 Gang Exploits Oracle WebLogic Server Flaws for Cryptocurrency Mining
Security researchers have shed more light on the cryptocurrency mining operation conducted by the 8220 Gang by exploiting known security flaws in the Oracle WebLogic Server. "The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware...
Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer
We analyze the multi-stage loading technique used by Water Sigbin to deliver the PureCrypter loader and XMRIG crypto miner...
Oyster Backdoor Spreading via Trojanized Popular Software Downloads
A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to drop a backdoor called Oyster aka Broomstick and CleanUpLoader. That's according to findings from Rapid7, which identified lookalike websites hosting the malicious payload...
PT-2024-32228
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ELF loader in the Linux kernel uses the randomize va space sysctl twice, which can change at any moment, potentially leading to unpredictable consequences if two loads see different...
esp-idf Anti-rollback Bypass
The vulnerability of the IoT application development environment loader espressif esp-idf is related to state management errors. Exploiting this vulnerability could allow an attacker to bypass anti-rollback protection mechanisms...
Cybercriminals Exploit Free Software Lures to Deploy Hijack Loader and Vidar Stealer
Threat actors are luring unsuspecting users with free or pirated versions of commercial software to deliver a malware loader called Hijack Loader, which then deploys an information stealer known as Vidar Stealer. "Adversaries had managed to trick users into downloading password-protected archive...
DEBIAN-CVE-2024-6064
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmtnodeend of the file src/scenemanager/loaderxmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to...
Info Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex’s Binaries for Initial Execution and Defense Evasion
Info Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex’s Binaries for Initial Execution and Defense Evasion By Ale Houspanossian · June 17, 2024 Case Summary It was a quiet Monday morning in March 2024 when the EDR researchers with our Trellix Advanced Research Center identifi...
PT-2024-37358 · Gpac +1 · Gpac +1
Name of the Vulnerable Software and Affected Versions: GPAC version 2.5-DEV-rev228-g11067ea92-master Description: A problem was found in the function xmt node end of the file src/scene manager/loader xmt.c of the component MP4Box. The issue leads to use after free. Local access is required to...
SUSE CVE-2024-37885
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLDINSERTLIBRARIES set in the enviroment. It is recommended that the Nextcloud...
OPENSUSE-SU-2024:10986-1 gdk-pixbuf-loader-rsvg-2.50.7-1.5 on GA media
These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.50.7-1.5 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:11593-1 gdk-pixbuf-loader-rsvg-2.52.2-2.1 on GA media
These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.52.2-2.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:12451-1 gdk-pixbuf-loader-libheif-1.12.0-5.1 on GA media
These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.12.0-5.1 package on the GA media of openSUSE Tumbleweed...