Threat Source newsletter (May 26, 2022) — BlackByte adds itself to the grocery list of big game hunters

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Given the recent tragedies in the U.S., I don’t feel it’s appropriate to open by being nostalgic or trying to be witty — let’s just stick to some security news this week. The one big... This is only the beginning!...

leonardbernstein.com Cross Site Scripting vulnerability OBB-2627967

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

earpdc.org Cross Site Scripting vulnerability OBB-2627950

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-42614

creationtimestamp| type| source ---|---|--- 2022-05-24 22:37:18+00:00| seen| https://t.me/cibsecurity/43297...

CVE-2022-29249

creationtimestamp| type| source ---|---|--- 2022-05-24 20:37:00+00:00| seen| https://t.me/cibsecurity/43279...

CVE-2022-31261

creationtimestamp| type| source ---|---|--- 2022-05-24 18:37:12+00:00| seen| https://t.me/cibsecurity/43262...

buckinghamford.co.uk Cross Site Scripting vulnerability OBB-2626114

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sailing360.com Cross Site Scripting vulnerability OBB-2625862

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

carterlake.org Cross Site Scripting vulnerability OBB-2625309

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

May 24, 2022 Preview update (KB5014020)

None None...

eduteka.icesi.edu.co Cross Site Scripting vulnerability OBB-2625203

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1268

creationtimestamp| type| source ---|---|--- 2022-05-23 12:35:33+00:00| seen| https://t.me/cibsecurity/43147...

joongdong.hs.kr Cross Site Scripting vulnerability OBB-2625188

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in @kibt/operation-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0c471df352822441445b896723595fb8555214cc80aaa429baabfcf3bd2010e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

fa21tv.com Cross Site Scripting vulnerability OBB-2625123

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Static Page eXtended plugin <= 2.1 - Arbitrary Settings Update via CSRF leading to Stored XSS

Arbitrary Settings Update via CSRF leading to Stored XSS discovered by Daniel Ruf in WordPress Static Page eXtended plugin versions = 2.1. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full...

diepumpe.de Cross Site Scripting vulnerability OBB-2623433

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

savigny.ub.uni-marburg.de Cross Site Scripting vulnerability OBB-2622238

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1423

creationtimestamp| type| source ---|---|--- 2022-05-19 22:29:57+00:00| seen| https://t.me/cibsecurity/43001...

Malicious code in ddc-new-relic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 724b8e2d9bbce93045922539d67f166495a0abac1fe3d410e5cea2ec861e82d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...