Security Vulnerabilities fixed in Firefox ESR 91.13 — Mozilla

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. A cross-origin iframe referencing an XSLT documen...

powerdns-recursor -- denial of service

PowerDNS Team reports: PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation...

CVE-2022-2557

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user...

CVE-2022-2557 WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user...

WordPress plugin Team 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2022-17373 · WordPress · Team Wordpress

Name of the Vulnerable Software and Affected Versions: The Team WordPress plugin versions prior to 4.1.2 Description: The issue allows any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is...

dnsReaper - Subdomain Takeover Tool For Attackers, Bug Bounty Hunters And The Blue Team!

DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate i...

DoNot Team Hackers Updated its Malware Toolkit with Improved Capabilities

The Donot Team threat actor has updated its Jaca Windows malware toolkit with improved capabilities, including a revamped stealer module designed to plunder information from Google Chrome and Mozilla Firefox browsers. The improvements also include a new infection chain that incorporates previousl...

Malicious Package

Overview opensea-wyvern is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview lusha-ui-components-v2 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview dobix is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was install...

CVE-2022-29507

Insufficiently protected credentials in the IntelR Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access...

Information disclosure

Insufficiently protected credentials in the IntelR Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2022-29507

Insufficiently protected credentials in the IntelR Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2022-29507

The CVE CVE-2022-29507 affects the Intel® Team Blue mobile application (all versions). The root cause is insufficient protection of credentials, potentially allowing an authenticated user to disclose information via local access. The issue is documented with a low CVSS base score (3.3/Low) and in...

CVE-2022-29507

Insufficiently protected credentials in the IntelR Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access...

Improper Authorization lead a user add an arbitrary agent into Team

Description A Vulnerability in edit team function lead an user add another user via ID to Team, alternatively know the email of every user in Chatwoot Step to reproduce - login to the app -navigate to the Team setting: https://app.chatwoot.com/app/accounts/id/settings/teams/list -Create new or ed...

Oil and Gas Cybersecurity: Recommendations Part 3

In the final part of our series, we look at the APT33 case study and several recommendations from our expert team...

Fixed in Apache Tomcat 8.5.82

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit 5f6c88b0. This issue was reported to the Apache Tomcat Securit...

Malicious Package

Overview @s3p-js-deep-purple/utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...