WordPress Multi Feed Reader plugin <= 2.2.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Multi Feed Reader versions = 2.2.4...

MAL-2024-10889 Malicious code in webpack-support-multi-domain-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df28dfaede54bce66eb7320e580118358e8db8869c014298d0a7abb4a0e43497 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Multi Feed Reader Plugin <=2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Feed Reader Type Plugin Vulnerable versions =2.2.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53718 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID d3cb59a47389 Credits Joshua Chan Required...

November 21, 2024-KB5048162 Cumulative Update Preview for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2

None None...

USDA Releases Success Story Detailing the Implementation of Phishing-Resistant Multi-Factor Authentication

Today, the Cybersecurity and Infrastructure Security Agency CISA and the U.S. Department of Agriculture USDA released Phishing-Resistant Multi-Factor Authentication MFA Success Story: USDA’s FIDO Implementation. This report details how USDA successfully implemented phishing-resistant authenticati...

Imperva and the Secure by Design Pledge: A Commitment to Cybersecurity Excellence

The Cybersecurity and Infrastructure Security Agency CISA has introduced a voluntary "Secure by Design Pledge" for enterprise software manufacturers, focusing on improving the security of their products and services. This pledge outlines seven key principles, forming the core of a robust...

CVE-2024-51873

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Masashi Takizawa Multi-day Booking Calendar multi-day-booking-calendar allows DOM-Based XSS.This issue affects Multi-day Booking Calendar: from n/a through = 1.0.1...

CVE-2024-51873 WordPress Multi-day Booking Calendar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Masashi Takizawa Multi-day Booking Calendar multi-day-booking-calendar allows DOM-Based XSS.This issue affects Multi-day Booking Calendar: from n/a through = 1.0.1...

CVE-2024-51873 WordPress Multi-day Booking Calendar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in matorel Multi-day Booking Calendar allows DOM-Based XSS.This issue affects Multi-day Booking Calendar: from n/a through 1.0.1...

Free AI editor lures in victims, installs information stealer instead on Windows and Mac

A large social media campaign was launched to promote a free Artificial Intelligence AI video editor. If the "free" part of that campaign sounds too good to be true, then that's because it was. Instead of the video editor, users got information stealing malware. Lumma Stealer was installed on...

How we helped expose a £12 million rental scam

TL;DR We helped Channel 4 with trying to track down rental scammers. We are not the police so we could only take it so far and any proving guilt or innocence would be a police matter. We saw organised approaches and elaborate setups. A lot of technical and money laundering techniques were needed...

WordPress plugin Multi-day Booking Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

GHSA-RP9H-RF7G-HWGR s2n-tls has undefined behavior at process exit

Impact s2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a...

Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10762 Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Updated libarchive packages fix security vulnerability

A heap-based out-of-bounds write vulnerability was discovered in libarchive, a multi-format archive and compression library, which may result in the execution of arbitrary code if a specially crafted RAR archive is processed. CVE-2024-20696...

CVE-2024-10038

CVE-2024-10038 — WP-Strava (WordPress) is an authenticated stored XSS vulnerability in the WP-Strava plugin up to version 2.12.1. The root cause is “insufficient input sanitization and output escaping” in admin settings, allowing an attacker with administrator-level permissions to inject scripts ...

CVE-2024-9999 Multi-Factor Authentication Bypass in Progress WS_FTP Server

In WSFTP Server versions before 8.8.9 2022.0.9, an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only...

Multi-vendor BIOS Security Vulnerabilities (November, 2024) - Lenovo Support US

No description provided...

kernel: cifs: fix mid leak during reconnection after timeout threshold

In the Linux kernel, the following vulnerability has been resolved: cifs: fix mid leak during reconnection after timeout threshold When the number of responses with status of STATUSIOTIMEOUT exceeds a specified threshold NUMSTATUSIOTIMEOUT, we reconnect the connection. But we do not return the mi...