HackerOne: Triager/Team members can edit hacker's report and hacker is not even notified

The hacker's report could be edited by a triager or team member without notifying the hacker, compromising the integrity of the report...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2023-3315

Summary Vulnerability CVE-2023-3315 affects the Team Concert plugin of IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2023-3315 DESCRIPTION: Jenkins Team Concert could allow a remote authenticated attacker to obtain sensitive information, caused by improper permission...

SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

CVE-2023-3315

Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

MITRE Unveils Top 25 Most Dangerous Software Weaknesses of 2023: Are You at Risk?

MITRE has released its annual list of the Top 25 "most dangerous software weaknesses" for the year 2023. "These weaknesses lead to serious vulnerabilities in software," the U.S. Cybersecurity and Infrastructure Security Agency CISA said. "An attacker can often exploit these vulnerabilities to tak...

How Talos IR’s Purple Team can help you prepare for the worst-case scenario

Purple Team exercises are included within the Cisco Talos Incident Response Retainer service and our experts can help your organization find security holes before the bad guys can. As your trusted advisor, our purple team, which is a combination of both red and blue teams, emulates one joint atta...

Meet NIST Compliance Standards Using Automation

Achieve NIST compliance for your business without slowing down your team...

How automation is evolving SecOps—and the real cost of cybercrime

This post is coauthored by Rob May, Founder and Managing Director, ramsac The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin = 1.2.1 versions...

CVE-2023-35048 WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin = 1.2.1 versions...

CVE-2023-35048

CVE-2023-35048 affects the WordPress plugin “Booking and Rental Manager for Bike” (also listed as MagePeople Booking and Rental Manager for Woo/Car/etc.) at versions ≤ 1.2.1. The root cause is improper input sanitization/escaping of plugin settings, enabling an authenticated (admin+) Stored Cross...

CVE-2023-27414

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Popup Box Team Popup box plugin = 3.4.4 versions...

WordPress BookIt 2.3.7 Authentication Bypass

On May 22, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in StylemixThemes’s BookIt plugin, which is actively installed on more than 10,000 WordPress websites. The vulnerability makes it possible for...

AssetRegistry.swapRegistered can be called with low gas to make basket be disabled

Lines of code Vulnerability details Impact Attacker can disable basket, when swapping or unregistering not basket asset. Proof of Concept AssetRegistry.swapRegistered and AssetRegistry.unregister are both functions that can be called by governance only. It's possible that after proposal is passed...

CVE-2023-35882

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

CVE-2023-35882

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

CVE-2023-35882 WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor Super Socializer plugin = 7.13.52 versions...

CVE-2023-35882

CVE-2023-35882 is a stored XSS vulnerability in WordPress plugin Team Heateor Super Socializer (≤7.13.52). The issue affects users with contributor or higher privileges, allowing injection of scripts via stored payloads. Patch guidance from multiple sources indicates the fix is in version 7.13.53...

Rogue Android Apps Target Pakistani Individuals in Sophisticated Espionage Campaign

Individuals in the Pakistan region have been targeted using two rogue Android apps available on the Google Play Store as part of a new targeted campaign. Cybersecurity firm Cyfirma attributed the campaign with moderate confidence to a threat actor known as DoNot Team, which is also tracked as...