Premium Addons for Elementor < 4.10.22 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, Team Members, and Image Scroll widgets due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and...

PT-2024-2072 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: The issue is related to a lack of proper authorization in requests fetching team-associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team they are not a member of...

Team Members < 5.3.2 - Author+ Stored XSS

Description The plugin does not validate and escape some of its Team options attributes before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks. 1. Create/edit a team and...

PT-2024-21643 · Unknown · Hoppscotch

Name of the Vulnerable Software and Affected Versions: Hoppscotch versions prior to 2023.12.6 Description: Hoppscotch is an API development ecosystem. Due to the lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with spoofed content as Hoppscotch. Part of t...

Team Members < 5.3.2 - Author+ Stored XSS

Description The plugin does not validate and escape some of its Team options attributes before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks. PoC 1. Create/edit a team...

Exploit for Deserialization of Untrusted Data in Torrentpier

CVE-2024-1651 This CVE was discovered by Carlos Bello from the...

New Leak Shows Business Side of China’s APT Menace

A new data leak that appears to have come from one of Chinas top private cybersecurity firms provides a rare glimpse into the commercial side of Chinas many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign...

CVE-2024-24798

Cross-Site Request Forgery CSRF vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10...

CVE-2024-24798

Cross-Site Request Forgery CSRF vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10...

CVE-2024-24798 WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10...

CVE-2024-24798

CVE-2024-24798 is a CSRF flaw in the WordPress Debug plugin up to version 1.10 (unathenticated exposure). PatchStack documents a fix in 1.11; upgrading to 1.11+ is recommended. NVD metrics show a high-severity vector (CVSS 3.1: 8.8 in some sources; PatchStack lists low severity 4.3) but the Patch...

PT-2024-20566 · Unknown · Soninow Team Debug

Name of the Vulnerable Software and Affected Versions: SoniNow Team Debug versions 1.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

CVE-2024-2065622

creationtimestamp| type| source ---|---|--- 2024-02-19 09:55:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6628...

Fixed in Apache Tomcat 10.1.19

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 0052b374. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Fixed in Apache Tomcat 11.0.0-M17

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit b0e3b1bd. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Fixed in Apache Tomcat 9.0.86

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 52d6650e. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Cupid in the cloud: celebrating developer and security team partnerships

In cloud security, the most compelling love story is the one between developers and security teams. This Valentine’s Day, let's shine a spotlight on these dynamic duos...

Security Updates for Microsoft Team Foundation Server and Azure DevOps Server (February 2024)

The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by a remote code execution vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key

Problem The plaintext value of $GLOBALS'SYS''encryptionKey' was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this...