CVE-2024-32148

CVE-2024-32148 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress Pardot plugin, affecting Pardot versions up to 2.1.0. The connected sources describe it as Missing Authorization/Broken Access Control; no explicit exploit, affected product/version details beyond thi...

CVE-2024-32148 WordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0...

CVE-2024-32148 WordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0...

Integration for Contact Form 7 and Salesforce <= <=1.3.9 - Cross-Site Request Forgery

Description The Integration for Contact Form 7 and Salesforce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, =1.3.9. This is due to missing or incorrect nonce validation on the settingspage function. This makes it possible for unauthenticated...

CVE-2024-34755

Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9...

CVE-2024-34755 WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9...

WordPress plugin Integration for Contact Form 7 and Salesforce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-26162 · WordPress · Integration For Contact Form 7/Salesforce

Name of the Vulnerable Software and Affected Versions: Integration for Contact Form 7 and Salesforce versions 1.3.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the specified software, allowing unauthorized actions to be performed on behalf of a user without their...

WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <=1.3.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms versions = 1.3.9...

WordPress Integration for Contact Form 7 and Salesforce Plugin <=1.3.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Integration for Contact Form 7 and Salesforce Type Plugin Vulnerable versions =1.3.9 Fixed in 1.4.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34755 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e633c3bb684...

Security Bulletin: IBM Planning Analytics Workspace has addressed multiple vulnerabilities

Summary IBM Planning Analytics Workspace is considered vulnerable to a Malicious File Upload vulnerability which could allow a privileged user to upload malicious files that can be automatically processed within the product CVE-2023-42017. This vulnerability has been addressed. IBM Planning...

Malicious code in salesforce-service-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a05b3238ddc7598095d1b1e72033916f8575b91475f84952ed92ffac09441d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1088 Malicious code in salesforce-service-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a05b3238ddc7598095d1b1e72033916f8575b91475f84952ed92ffac09441d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Silver SAML Attack Evades Golden SAML Defenses in Identity Systems

Cybersecurity researchers have disclosed a new attack technique called Silver SAML that can be successful even in cases where mitigations have been applied against Golden SAML attacks. Silver SAML "enables the exploitation of SAML to launch attacks from an identity provider like Entra ID against...

Security Bulletin: IBM Event Streams is affected by a remote code execution vulnerability (CVE-2023-26136).

Summary A Remote Code Execution RCE vulnerability in Salesforce tough-cookie could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. Vulnerability Detai...

Juniper Support Portal Exposed Customer Device Info

Until earlier this week, the support website for networking equipment vendor Juniper Networks was exposing potentially sensitive information tied to customer products, including which devices customers bought, as well as each products warranty status, service contracts and serial numbers. Juniper...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable toSalesforce tough-cookie arbitrary code execution vulnerabilitiy [CVE-2023-26136]

Summary Potential Salesforce tough-cookie arbitrary code execution vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-26136 Vulnerability Details...

Security Bulletin: CVE-2023-21830 and CVE-2023-21843 may affect IBM® SDK, Java™ Technology Edition shipped with IBM TXSeries for Multiplatforms

Summary CVE-2023-21830 and CVE-2023-21843 may affect IBM® SDK, Java™ Technology Edition shipped with IBM TXSeries for Multiplatforms. IBM TXSeries for Multiplatforms has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21830 DESCRIPTION: An unspecified vulnerability in Java SE...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-29827 DESCRIPTION: Node.js ejs module could allow a remote authenticated attacker t...

U.S. Dept Of Defense: ███ leaking PII of tour visitors (names, email addresses, phone numbers) via misconfigured record permissions

The ████████ portal was found to be leaking sensitive personal information, including full names, email addresses, and phone numbers of its users. The issue was caused by a misconfiguration that allowed registered users to access records of other users, potentially exposing the data of hundreds o...