CLSA-2022-1664475299 Fix CVE(s): CVE-2022-3256

SECURITYUPDATE: Using freed memory when autocmd changes mark - debian/patches/CVE-2022-3256.patch: Copy the mark before editing another buffer - CVE-2022-3256...

CVE-2022-40673

KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache...

CVE-2022-36020 Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot...

be.cylab.mark:client (>=0.0.20 <=2.6.0), be.cylab.mark:core (>=0.0.20 <=2.6.0) +3 more potentially affected by CVE-2022-38749 via be.cylab:snakeyaml (=1.25.1)

be.cylab:snakeyaml MAVEN version =1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on be.cylab:snakeyaml and may be impacted: - be.cylab.mark:client =0.0.20, =0.0.20, =1.3.1, =0.0.22, =0.0.20, =2.3.0 Source cves: CVE-2022-38749 Source advisory:...

Wordfence Intelligence Launching at Black Hat 2022 in Las Vegas Next Week

Wordfence protects over 4 million websites around the world on 12,000 unique networks, and we block over 1.8 billion attacks targeting those websites every month. For years we have had a relationship with our customers that is a virtuous cycle: We receive attack reports from our customers at a ra...

Threat Actors Pivot Around Microsoft’s Macro-Blocking in Office

Threat actors are finding their way around Microsoft’s default blocking of macros in its Office suite, using alternative files to host malicious payloads now that a primary channel for threat delivery is being cut off, researchers have found. The use of macros-enabled attachments by threat actors...

CLSA-2022-1658172267 Fix CVE(s): CVE-2022-2206, CVE-2022-2257, CVE-2022-2286, CVE-2022-2285, CVE-2022-2284, CVE-2022-2287, CVE-2022-2264

SECURITY UPDATE: Out-of-bound read in function msgouttransattr - debian/patches/CVE-2022-2206.patch: Adjust cmdlinerow and msgrow to the value of Rows. - CVE-2022-2206 SECURITY UPDATE: Heap-based buffer overflow in function utfcptr2len - debian/patches/CVE-2022-2284.patch: Stop Visual mode when...

CLSA-2022-1658171898 Fixed 7 CVEs in vim

CVE-2022-2206: adjust cmdlinerow and msgrow to the value of Rows - CVE-2022-2284: stop visual mode when closing a window - CVE-2022-2285: put a NUL after the typeahead - CVE-2022-2286: check the length of the string - CVE-2022-2287: disallow adding a word with control characters or a trailing...

Fixed 7 CVEs in vim

CVE-2022-2206: adjust cmdlinerow and msgrow to the value of Rows - CVE-2022-2284: stop visual mode when closing a window - CVE-2022-2285: put a NUL after the typeahead - CVE-2022-2286: check the length of the string - CVE-2022-2287: disallow adding a word with control characters or a trailing...

CLSA-2022-1658171278 Fixed 7 CVEs in vim

CVE-2022-2206: adjust cmdlinerow and msgrow to the value of Rows - CVE-2022-2284: stop visual mode when closing a window - CVE-2022-2285: put a NUL after the typeahead - CVE-2022-2286: check the length of the string - CVE-2022-2287: disallow adding a word with control characters or a trailing...

mark-bishop.net Cross Site Scripting vulnerability OBB-2776020

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

7-Zip gets Mark of the Web feature, increases protection for users

One of the most popular zip programs around, 7-Zip, now offers support for "Mark of the Web" MOTW, which gives users better protection from malicious files. This is good news. But what does that actually mean? In the bad old days, opening up a downloaded document could be a fraught exercise...

Adconion Execs Plead Guilty in Federal Anti-Spam Case

At the outset of their federal criminal trial for hijacking vast swaths of Internet addresses for use in large-scale email spam campaigns, three current or former executives at online advertising firm Adconion Direct now Amobee have pleaded guilty to lesser misdemeanor charges of fraud and...

A Bootiful Podcast: Devoxx UK organizer and VoxxedDays cofounder Mark Hazell on running great conferences

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Devoxx UK organizer and Voxxed Days cofounder Mark Hazell @mrhazell...

WordPress plugin Mark Daniels Night Mode cross-site scripting vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.The WordPress plugin Mark Daniels Night Mode 1.0.0 and previous versions have a cross-site scripting vulnerability, which originates from a...

Cross site scripting

Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...

CVE-2022-29418 WordPress Night Mode plugin <= 1.0.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...

CVE-2022-29418

CVE-2022-29418 affects the WordPress plugin Night Mode (Mark Daniels Night Mode) at versions

WordPress Mark Posts plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Mark Posts plugin has a cross-site scripting...

CVE-2022-0958

The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...