WordPress Blox Page Builder Plugin <= 1.0.65 is vulnerable to Arbitrary File Upload

Software Blox Page Builder Type Plugin Vulnerable versions = 1.0.65 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6315 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID ffdf8c3e90d1 Credits István Márton Required privilege...

WordPress WordPress File Upload Plugin < 4.24.8 is vulnerable to Cross Site Scripting (XSS)

Software WordPress File Upload Type Plugin Vulnerable versions 4.24.8 Fixed in 4.24.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6651 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f705fe24e0ac Credits Đức Tài...

WordPress Cooked Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Cooked Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-41816 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 18a7c8d0faab Credits re-alter Required privilege Subscriber...

WordPress Zephyr Project Manager Plugin <= 3.3.100 is vulnerable to Cross Site Scripting (XSS)

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.100 Fixed in 3.3.101 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7356 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0c46a2e71933 Credits wesley...

APT28 Targets Diplomats with HeadLace Malware via Car Sale Phishing Lure

A Russia-linked threat actor has been linked to a new campaign that employed a car for sale as a phishing lure to deliver a modular Windows backdoor called HeadLace. "The campaign likely targeted diplomats and began as early as March 2024," Palo Alto Networks Unit 42 said in a report published...

Webinar: Discover the All-in-One Cybersecurity Solution for SMBs

In today's digital battlefield, small and medium businesses SMBs face the same cyber threats as large corporations, but with fewer resources. Managed service providers MSPs are struggling to keep up with the demand for protection. If your current cybersecurity strategy feels like a house of cards...

CVE-2024-6923

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CVE-2024-6923 Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CVE-2024-6923

CVE-2024-6923 is noted in a connected document as affecting the TensorFlow package on affected systems for versions less than 2.16.1-9; a patched version is available. No other technical details (root cause, exploit, or vectors) are provided in the sources.

WordPress WooCommerce Customers Manager Plugin < 30.2 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 30.2 Fixed in 30.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1747 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e74aefc31812 Credits Erwan LR...

WordPress Tin Canny Reporting for LearnDash Plugin <= 4.3.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Tin Canny Reporting for LearnDash Type Plugin Vulnerable versions = 4.3.0.7 Fixed in 4.3.0.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39656 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e6e93ecaf931 Credits Dave Jong...

WordPress LiquidPoll – Advanced Polls for Creators and Brands Plugin <= 3.3.77 is vulnerable to Cross Site Scripting (XSS)

Software LiquidPoll – Advanced Polls for Creators and Brands Type Plugin Vulnerable versions = 3.3.77 Fixed in 3.3.78 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39655 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a190a4c0c44f...

Advisory ROSA-SA-2024-2459

Software: systemd 239 OS: ROSA Virtualization 2.1 packageevrstring: systemd-239 CVE-ID: CVE-2018-21029 BDU-ID: None CVE-Crit: CRITICAL. CVE-DESC.: systemd accepts any certificate signed by a trusted certificate authority for DNS Over TLS. No server name indication SNI is sent, and there is no...

WordPress VForm Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software VForm Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6770 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 84552ffa98ca Credits Artem Polynko Artem Polynko...

Exploit for Path Traversal in Fujitsu Network_Edgiot_Gw1500_Firmware

CVE-2024-40617 Exploit PoC for CVE-2024-40617 Description...

WordPress Donation Block For PayPal Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Donation Block For PayPal Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6021 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 49c1f9f09af2 Credits Bob Matyas...

WordPress Web Directory Free Plugin < 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Web Directory Free Type Plugin Vulnerable versions 1.7.2 Fixed in 1.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3669 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b9412ec31068 Credits Simone Onofri Kim...

WordPress WP Ajax Contact Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Ajax Contact Form Type Plugin Vulnerable versions = 2.2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5809 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1bf246662eb Credits Bob Matyas...

CVE-2024-3219 Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection

The “socket” module provides a pure-Python fallback to the socket.socketpair function for platforms that don’t support AFUNIX, such as Windows. This pure-Python implementation uses AFINET or AFINET6 to create a local connected pair of sockets. The connection between the two sockets was not verifi...

CVE-2024-3219

The “socket” module provides a pure-Python fallback to the socket.socketpair function for platforms that don’t support AFUNIX, such as Windows. This pure-Python implementation uses AFINET or AFINET6 to create a local connected pair of sockets. The connection between the two sockets was not verifi...