PT-2024-38166

Name of the Vulnerable Software and Affected Versions: eWeLink Cloud Service versions prior to 2.19.0 eWeLink Cloud Service versions up to 2.18.x Description: When a device is shared, the homepage module in eWeLink Cloud Service allows a secondary user to take over devices as a primary user by...

US senators ask FTC to investigate car makers’ privacy practices

An ongoing US Senate investigation indicated that connected car makers violate consumer privacy by sharing and selling drivers’ data, including their location, on a vast scale, and that the same car makers often obtain consumer consent through deception. Based on this investigation, senators have...

About the security content of iOS 17.6 and iPadOS 17.6

About the security content of iOS 17.6 and iPadOS 17.6 This document describes the security content of iOS 17.6 and iPadOS 17.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

About the security content of watchOS 10.6

About the security content of watchOS 10.6 This document describes the security content of watchOS 10.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

About the security content of tvOS 17.6

About the security content of tvOS 17.6 This document describes the security content of tvOS 17.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

PT-2024-24448

Name of the Vulnerable Software and Affected Versions Ankitects Anki version 24.04 Description A blocklist bypass issue exists in the LaTeX functionality, allowing a specially crafted malicious flashcard to create an arbitrary file at a fixed path. An attacker can trigger this issue by sharing a...

CVE-2024-40725

creationtimestamp| type| source ---|---|--- 2024-07-18 10:13:30+00:00| seen| https://t.me/HackingInsights/6516 2024-07-18 13:27:13+00:00| seen| https://t.me/cvedetector/1150 2024-07-19 03:58:31+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/8023 2024-07-20 15:31:46+00:00|...

CVE-2024-36412

creationtimestamp| type| source ---|---|--- 2024-07-17 15:58:21+00:00| published-proof-of-concept| https://t.me/softrinx/424 2024-07-17 15:58:21+00:00| published-proof-of-concept| https://t.me/softrinx/143160 2024-07-17 16:15:23+00:00| published-proof-of-concept| https://t.me/realLulzSec/13806...

A week in security (July 8 – July 14)

Last week on Malwarebytes Labs: "Nearly all" AT&T customers had phone records stolen in new data breach disclosure Fake Microsoft Teams for Mac delivers Atomic Stealer Dangerous monitoring tool mSpy suffers data breach, exposes customer details iPhone users in 98 countries warned about spyware by...

Supportability- Remote Support on Android Devices with Samsung Knox

Remote Support on Android Devices are only supported with Samsung Knox. There are two types of remote support one can enable for a Samsung KNOX device: Basic Support: This allows us to view diagnostic information about the device,for examplesystem information, processes that are running, task...

Session Sharing Explained with Troubleshooting Steps

This article explains session sharing and discusses some common scenarios. Session sharing is the ability of a seamless published application to be executed over the same connection as other seamless applications that are already running on the same server, under an existing Session ID of a user...

CVE-2024-39904 Code Execution Vulnerability via Local File Path Traversal in Vnote

VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example,...

CVE-2024-39900

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

CVE-2024-3563

The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-3228 Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure

The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts...

WordPress Genesis Blocks plugin <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Sharing Block Attributes vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Genesis Blocks versions = 3.1.3...

PT-2024-26575 · WordPress · Genesis Blocks

Name of the Vulnerable Software and Affected Versions: Genesis Blocks plugin for WordPress versions up to, and including, 3.1.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Sharing block due to insufficient input sanitization and output escaping on user-suppli...

WordPress plugin Genesis Blocks security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Devika Access Control Error Vulnerability

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches relevant information, and writes code to achieve a given goal. Devika suffers from an access control error vulnerability that stems from a...

Devika Cross-Site Scripting Vulnerability

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches relevant information, and writes code to achieve a given goal. Devika suffers from a cross-site scripting vulnerability that stems from improper...