PT-2024-35316 · Unknown · Fediverse Embeds

Name of the Vulnerable Software and Affected Versions: Fediverse Embeds versions n/a through 1.5.3 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to the compromise of the web server...

About Elevation of Privilege – PAN-OS (CVE-2024-9474) vulnerability

About Elevation of Privilege - PAN-OS CVE-2024-9474 vulnerability. An attacker with PAN-OS administrator access to the management web interface can perform actions on the Palo Alto device with root privileges. Linux commands can be injected via unvalidated input in script. The need for...

Exploit for Code Injection in Geoserver

CVE-2024-36401-WoodpeckerPlugin Introduction CVE-2024-36...

PT-2024-35214 · Bdthemes · Bdthemes Instant Image Generator

Name of the Vulnerable Software and Affected Versions: BdThemes Instant Image Generator versions 1.5.4 and earlier Description: The issue allows an attacker to upload a web shell to a web server due to an Unrestricted Upload of File with Dangerous Type vulnerability. This enables attackers to...

PT-2024-35210 · Unknown · Devexhub Gallery

Name of the Vulnerable Software and Affected Versions: Devexhub Gallery versions n/a through 2.0.1 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to potential exploitation and...

K000148482: Sudo vulnerability CVE-2019-19234

Security Advisory Description In Sudo through 1.8.29, the fact that a user has been blocked e.g., by using the ! character in the shadow file instead of a password hash is not considered, allowing an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The...

IcePeony and Transparent Tribe Target Indian Entities with Cloud-Based Tools

High-profile entities in India have become the target of malicious campaigns orchestrated by the Pakistan-based Transparent Tribe threat actor and a previously unknown China-nexus cyber espionage group dubbed IcePeony. The intrusions linked to Transparent Tribe involve the use of a malware called...

CVE-2024-50529

Unrestricted Upload of File with Dangerous Type vulnerability in Rudra Innnovative Software Training – Courses allows Upload a Web Shell to a Web Server.This issue affects Training – Courses: from n/a through 2.0.1...

PT-2024-34309 · Unknown · Rsvpmaker For Toastmasters

Name of the Vulnerable Software and Affected Versions: RSVPMaker for Toastmasters versions prior to 6.2.4 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This poses a risk of web server compromise...

PT-2024-34273 · Widgilabs · Widgilabs Plugin Propagator

Name of the Vulnerable Software and Affected Versions: WidgiLabs Plugin Propagator versions 0.1 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized acces...

WordPress plugin Custom Icons for Elementor 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2024-33609 · Unknown · Ecomerciar Woocommerce Custom Profile Picture

Name of the Vulnerable Software and Affected Versions: Ecomerciar Woocommerce Custom Profile Picture versions 1.0 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. Recommendations: For...

WordPress plugin INK Official 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

CVE-2024-49610

Unrestricted Upload of File with Dangerous Type vulnerability in Jack Zhu allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through 1.0...

PT-2024-33562 · Redwan Hilali · Wp Dropbox Dropins

Name of the Vulnerable Software and Affected Versions: Redwan Hilali WP Dropbox Dropins versions 1.0 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can potentially compromise web servers...

Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks

A hacktivist group known as Twelve has been observed using an arsenal of publicly available tools to conduct destructive cyber attacks against Russian targets. "Rather than demand a ransom for decrypting data, Twelve prefers to encrypt victims' data and then destroy their infrastructure with a...

-=TWELVE=- is back

In the spring of 2024, posts with real people's personal data began appearing on the -=TWELVE=- Telegram channel. Soon it was blocked for falling foul of the Telegram terms of service. The group stayed off the radar for several months, but as we investigated a late June 2024 attack, we found that...

Gether 6SHR System 代码问题漏洞

Gether 6SHR System is a system from Gether, Inc. A code issue vulnerability exists in the Gether 6SHR System that stems from not properly validating uploaded file types, allowing a remote attacker with regular privileges to upload Web shell scripts and use them to execute arbitrary system command...

APT41 Infiltrates Networks in Italy, Spain, Taiwan, Turkey, and the U.K.

Several organizations operating within global shipping and logistics, media and entertainment, technology, and automotive sectors in Italy, Spain, Taiwan, Thailand, Turkey, and the U.K. have become the target of a "sustained campaign" by the prolific China-based APT41 hacking group. "APT41...

CVE-2024-5630

The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites...