PT-2024-26116 · Gz::Ctf · Gz::Ctf

Name of the Vulnerable Software and Affected Versions: GZ::CTF versions prior to 0.20.1 Description: The issue allows an unprivileged user to perform cross-site scripting attacks on other users by constructing malicious team names. Recommendations: For versions prior to 0.20.1, update to version...

CVE-2024-34220

creationtimestamp| type| source ---|---|--- 2024-05-11 07:42:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7271...

VulnCheck KEV: CVE-2024-34826

Missing Authorization vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler.This issue affects CF7 WOW Styler: from n/a through = 1.6.4...

CVE-2024-26517

creationtimestamp| type| source ---|---|--- 2024-05-08 20:34:28+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7251...

Soccer Engine – Soccer Plugin for WordPress < 1.13 - Cross-Site Request Forgery

Description The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for...

CVE-2024-34367

Cross-Site Request Forgery CSRF vulnerability in Popup Box Team Popup box allows Cross-Site Scripting XSS.This issue affects Popup box: from n/a through 4.1.2...

CVE-2024-34367

CVE-2024-34367: CSRF leads to XSS in Popup Box – Popup Box plugin (ays-popup-box) for WordPress; affected versions up to 4.1.2. Patch status: Patched (fix details not provided in the supplied docs).

PT-2024-25825 · Popup Box · Popup Box

Name of the Vulnerable Software and Affected Versions: Popup box versions n/a through 4.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that also allows Cross-Site Scripting XSS in the Popup Box Team Popup box. Recommendations: For versions n/a through 4.1.2, update ...

[SECURITY] Debian 10 LTS will reach end-of-life on June 30th, 2024

Dear Debian LTS users, This is a gentle reminder that Debian 10 "buster" will reach end of support as the LTS release on June 30, 2024. Users are encouraged to upgrade to Debian 11 "bullseye". Starting in July, Debian will not provide further security updates for Debian 10. A subset of buster...

[SECURITY] Debian 10 LTS will reach end-of-life on June 30th, 2024

Dear Debian LTS users, This is a gentle reminder that Debian 10 "buster" will reach end of support as the LTS release on June 30, 2024. Users are encouraged to upgrade to Debian 11 "bullseye". Starting in July, Debian will not provide further security updates for Debian 10. A subset of buster...

Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control C&C infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of...

CVE-2024-33927

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affects Giphypress: from n/a through 1.6.2...

CVE-2024-33927

CVE-2024-33927 affects Team GIPHY Giphypress (WordPress plugin). The issue is a Stored XSS caused by improper neutralization during web page generation, impacting Giphypress versions up to 1.6.2. Public details in the connected sources confirm the vulnerability type and affected range; as of the ...

CVE-2024-33927 WordPress Giphypress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affects Giphypress: from n/a through 1.6.2...

CVE-2024-33927 WordPress Giphypress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affects Giphypress: from n/a through 1.6.2...

CVE-2024-4003

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eaelteammembersimagerounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to...

CVE-2024-4003 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eaelteammembersimagerounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to...

The Take Command Summit: A Stacked Agenda, and Killer Guest Speakers Coming Your Way May 21

By now you should have heard about Take Command, Rapid7’s day-long virtual summit on May 21 bringing together some of the best minds in the cybersecurity sphere for comprehensive discussions on the latest data, challenges, and opportunities in the industry. It’s an opportunity to expand your...

WordPress plugin Essential Addons for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-28760 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.15 Description: The issue is related to Stored Cross-Site Scripting via the eael team...