CVE-2023-37982 WordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open Redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3...

PT-2023-26230 · Salesforce · Salesforce

Name of the Vulnerable Software and Affected Versions: CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms versions n/a through 1.3.3 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This...

WordPress plugin Integration for Contact Form 7 and Salesforce Input Validation Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An input validation error vulnerability...

Release Information for Veeam Backup for Salesforce 2 Cumulative Patches

This update has been superseded by Veeam Backup for Salesforce 3. Requirements Please confirm that you are running Veeam Backup for Salesforce 2.1 build 2.1.0.4675 or earlier before upgrading. You can find the currently installed build number in the Configuration About section. After the upgrade,...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver (CVE-2023-26136, CVE-2022-25883).

Summary IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver CVE-2023-26136, CVE-2022-25883. The fix includes versions tough-cookie =4.1.3 & semver =7.5.4 and 5.7.2 Vulnerability Details CVEID:CVE-2023-26136 DESCRIPTION...

appexchange.salesforce.com Cross Site Scripting vulnerability OBB-3668208

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

avid--aviduat.sandbox.my.salesforce-sites.com Cross Site Scripting vulnerability OBB-3667681

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM Cognos Dashboards on IBM Cloud Pak for Data has addressed security vulnerabilities (CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222, CVE-2023-26136)

Summary A Remote Code Execution RCE vulnerability in Salesforce tough-cookie CVE-2023-26136 and vulnerabilities reported in the Node.js July 2022 Security Release CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222 have been resolved in IBM Cognos Dashboards on IBM Clou...

Security Bulletin: IBM Edge Application Manager 4.5.2 addresses the security vulnerabilities listed in the CVEs below.

Summary IBM Edge Application Manager 4.5.2 addresses the security vulnerabilities listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the new...

d58000000yexzeac.my.salesforce-sites.com Cross Site Scripting vulnerability OBB-3584767

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Phishers Exploit Salesforce's Email Services Zero-Day in Targeted Facebook Campaign

A sophisticated Facebook phishing campaign has been observed exploiting a zero-day flaw in Salesforce's email services, allowing threat actors to craft targeted phishing messages using the company's domain and infrastructure. "Those phishing campaigns cleverly evade conventional detection methods...

org.apache.nifi.minifi:minifi-assembly (=1.22.0), org.apache.nifi:nifi-record-serialization-services-nar (>=1.10.0 <=1.22.0) +6 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-record-serialization-services (>=1.10.0 <=1.22.0)

org.apache.nifi:nifi-record-serialization-services MAVEN version =1.10.0, =1.10.0, =0.2.2, =0.2.2, =0.2.2, =0.2.2, =0.2.3 Source cves: CVE-2023-36542 Source advisory: OSV:GHSA-R969-8V3H-23V9...

WordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open Redirection

Software Integration for Contact Form 7 and Salesforce Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-37982 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 176767c35020 Credits ...

Malicious code in salesforce-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf2a69a3613a2fc56dfb5d3eb3f2b0289bf2f9c8b0db94caf8d754699c12d175 The OpenSSF Package Analysis project identified 'salesforce-ux' @ 1.6.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1286 Malicious code in salesforce-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf2a69a3613a2fc56dfb5d3eb3f2b0289bf2f9c8b0db94caf8d754699c12d175 The OpenSSF Package Analysis project identified 'salesforce-ux' @ 1.6.1 npm as malicious. It is considered malicious because: - The package...

Beware of Ghost Sites: Silent Threat Lurking in Your Salesforce Communities

Improperly deactivated and abandoned Salesforce Sites and Communities aka Experience Cloud could pose severe risks to organizations, leading to unauthorized access to sensitive data. Data security firm Varonis dubbed the abandoned, unprotected, and unmonitored resources "ghost sites." "When these...

Beware of Ghost Sites: Silent Threat Lurking in Your Salesforce Communities

Improperly deactivated and abandoned Salesforce Sites and Communities aka Experience Cloud could pose severe risks to organizations, leading to unauthorized access to sensitive data. Data security firm Varonis dubbed the abandoned, unprotected, and unmonitored resources "ghost sites." "When these...

Security Bulletin: CVE-2023-24998 may affect IBM TXSeries for Multiplatforms

Summary CVE-2023-24998 may affect IBM WebSphere Application Server Liberty used by IBM TXSeries for Multiplatforms . TXSeries for Multiplatforms has addressed the applicable CVEs. Updated Liberty is provided as special fix and fix is uploaded to Fix Central. Vulnerability Details...

developer.salesforce.com Cross Site Scripting vulnerability OBB-3281286

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Many Public Salesforce Sites are Leaking Private Data

A shocking number of organizations -- including banks and healthcare providers -- are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an...