15315 matches found
CVE-2023-51691 WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12...
CVE-2023-51691
CVE-2023-51691 concerns the WordPress plugin wpDiscuz, where versions n/a through 7.6.12 are affected by a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The root cause is input not being properly sanitized, enabling an attacker...
PT-2024-14460 · Unknown · Live Composer Team Page Builder
Name of the Vulnerable Software and Affected Versions: Live Composer Team Page Builder versions 1.5.23 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...
PurpleKeep - Providing Azure Pipelines To Create An Infrastructure And Run Atomic Tests
With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually re-running...
Code injection
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in InstaWP Team InstaWP Connect – 1-click WP Staging & Migration.This issue affects InstaWP Connect – 1-click WP Staging & Migration: from n/a through 0.1.0.9...
CVE-2024-23506
CVE-2024-23506 affects the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin, specifically versions 0.1.0.9 and earlier. The issue is Exposure of Sensitive Information to an Unauthorized Actor (information disclosure). Public documentation consistently ties the vulnerability to In...
CVE-2024-21630 Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite...
CVE-2024-21630
CVE-2024-21630 (Zulip) describes a flaw in Zulip 8.0 where non-admins can invite users and create multi‑use invitations, while only admins can invite users to streams. The vulnerability is limited to streams the inviter can already see and is not an arbitrary- stream invite. Version 8.1 fixes the...
Building the Best SOC Takes Strategic Thinking
So your security team is ready to scale up its security operations center, or SOC, to better meet the security needs of your organization. That’s great news. But there are some very important strategic questions that need to be answered if you want to build the most effective SOC you can and avoi...
WordPress WP Go Maps Plugin <= 9.0.28 is vulnerable to Cross Site Scripting (XSS)
Software WP Go Maps Type Plugin Vulnerable versions = 9.0.28 Fixed in 9.0.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6697 Patch priority Medium CVSS severity Medium 7.1 Developer WP Go Maps PSID a5d68fb003d8 Credits Nex Team Required privileg...
GS Team Members < 2.2.4 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...
CVE-2023-40551
A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase...
suricata -- multiple vulnerabilities
Suricata team reports: Multiple vulnerabilities fixed in the last release of suricata. No details have been disclosed yet...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress a...
CVE-2022-40700 Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins
Server-Side Request Forgery SSRF vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress a...
Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard
The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. Microsoft has identified the threat...
FalconHound - A Blue Team Multi-Tool. It Allows You To Utilize And Enhance The Power Of Blo odHound In A More Automated Fashion
FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool. One of the challenging aspects of BloodHound is that it is a snapshot in time...
Unit Testing Frameworks: A Quick Comparison
Stepping Forward in Understanding Software Unit Evaluation Venturing into the realm of software creation, emphasizing quality takes center stage. This gold standard governs aspects such as operational capabilities, dependability, and the overall performance of your software. Regular assessments, ...
CVE-2024-22410 Binary Planting Attack on Windows Platforms in Creditcoin
Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute...
