ToddyCat exploits unknown vulnerability in Microsoft Exchange servers to targets entities in Europe and Asia

Threat Level Actor Report For a detailed advisory, download the pdf file here Summary ToddyCat, an APT group is deploying web shells by exploiting an unknown vulnerability in the Microsoft Exchange Servers. They are initiating a multi-stage infection that aims at governmental bodies in Europe and...

EulerOS 2.0 SP8 : git (EulerOS-SA-2022-1929)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where...

WordPress Multi-page Toolkit plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Multi-page Toolkit plugin 2.6 and earlier versions are vulnerable to cross-site request forgery,...

The vulnerability of the proxy-capsule-proxy module of the Capsule software tool, which allows for multi-tenancy in Kubernetes, enables attackers to increase their privileges.

The vulnerability of the capsule-proxy module of the Capsule software solution for providing multi-tenancy in Kubernetes is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability (CVE-2021-25748)

Summary IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the...

ASG technologies ASG-Zena Cross Platform Server Enterprise Edition Cross-Site Scripting Vulnerability

ASG technologies ASG-Zena Cross Platform Server Enterprise Edition is a modern multi-platform workload automation solution from ASG technologies, Inc. A cross-site scripting vulnerability exists in ASG technologies ASG-Zena Cross Platform Server Enterprise Edition version 4.2.1, which stems from...

Online Ordering System SQL Injection Vulnerability (CNVD-2022-55713)

Online Ordering System is a multi-store ordering system that can be used by any small business. an SQL injection vulnerability exists in Online Ordering System version v2.3.2, which originates from /ordering/admin/store/index.php?view=edit&id= Lack of validation of external input SQL statements c...

Online Ordering System SQL Injection Vulnerability (CNVD-2022-55711)

Online Ordering System is a multi-store ordering system that can be used by any small business.Online Ordering System version v2.3.2 is vulnerable to SQL injection, which originates from /ordering/index.php?q=category&search=Lack of validation of external input SQL statement validation, an attack...

MAL-2022-6820 Malicious code in url-multi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5715c2f7477bfb9fb101c5486a17aa63e012dfc2bf9cb4e8c54bf6b1879e1eba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in url-multi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5715c2f7477bfb9fb101c5486a17aa63e012dfc2bf9cb4e8c54bf6b1879e1eba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6147 Malicious code in sketch-multi-lingual-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dc963980cef03ca59ff4df6236056bfe2d4a7bb38df9f9c2aed51bc8869a0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6734 Malicious code in ucs-multi-series-line-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ae50640818d0dd907fe7a22c27ef0627f0c3f001c66d489e08a4a0c8702a9eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucs-multi-series-line-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ae50640818d0dd907fe7a22c27ef0627f0c3f001c66d489e08a4a0c8702a9eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-186 Malicious code in @crackle-fixtures/multi-entry-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b947e49cb6f0a8e988511d9e9b78b3cb92a5b74b3867030a23c0634171151762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7311 Malicious code in yahoo-react-multi-select-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59b42c16c52333b42adb394c8784f37abd19319bd11704e6381f6c1af61d4d1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1818

The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well...

CVE-2022-1818

The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well...

Cross site scripting

The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well...

CVE-2022-1818

CVE-2022-1818 affects the WordPress plugin Multi-page Toolkit (versions up to 2.6). The vulnerability arises from a missing CSRF check when updating plugin settings, which could allow an authenticated admin to perform a CSRF attack that changes settings. This, combined with insufficient sanitisat...

CVE-2022-1818 Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF

The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well...