Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks

The threat actor known as Muddled Libra has been observed actively targeting software-as-a-service SaaS applications and cloud service provider CSP environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Pa...

CVE-2024-31434

Cross-Site Request Forgery CSRF vulnerability in Stefano Lissa & The Newsletter Team Newsletter.This issue affects Newsletter: from n/a through 8.0.6...

CVE-2024-31433

Cross-Site Request Forgery CSRF vulnerability in StellarWP The Events Calendar the-events-calendar.This issue affects The Events Calendar: from n/a through = 6.3.0...

CVE-2024-31428

Cross-Site Request Forgery CSRF vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0...

CVE-2024-31428

Cross-Site Request Forgery CSRF vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0...

CVE-2024-31428

CVE-2024-31428 is a CSRF vulnerability in the WordPress theme The Conference (Rara Theme) affecting versions up to and including 1.2.0. The connected Red Hat entry reiterates the same description. Public details in the provided documents do not specify affected builds beyond “n/a through 1.2.0,” ...

CVE-2024-31433

Technical details for CVE-2024-31433 are not provided in the supplied documents. No vendor/product/exploit specifics, impact, or patch data are present here. Please monitor official advisories and vulnerability databases for updates.

CVE-2024-31434

Technical details for CVE-2024-31434 are not provided in the supplied documents. Monitor official advisories for affected Newsletter plugin versions up to 8.0.6 and vendor patches.

Palo Alto Networks PAN-OS Trust Management Issues Vulnerability

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. Palo Alto Networks PAN-OS is vulnerable to a trust management issue that arises from the use of weak low bit strength device certificates. An attacker could exploit this vulnerability to perform a...

PT-2024-24075 · Unknown · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar versions n/a through 6.3.0 Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the us...

IBM Security verify Access Appliance Security Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

IBM Security verify Access Appliance Trust Management Issue Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as the Web, mobile, IoT and cloud using risk-based access, single sign-on, integrated access management controls...

WordPress Plugin The Events Calendar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2024-30407

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router JCNR and containerized routing Protocol Deamon cRPD products allows an attacker to perform Person-in-the-Middle PitM attacks which results in complete compromise of the container. Due to...

CVE-2024-30407 [Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router JCNR and containerized routing Protocol Deamon cRPD products allows an attacker to perform Person-in-the-Middle PitM attacks which results in complete compromise of the container. Due to...

CVE-2024-30407

The CVE-2024-30407 entry details a vulnerability in Juniper Networks JCNR and containerized routing Protocol Daemon (cRPD) caused by hard-coded cryptographic keys and SSH host keys in containers, enabling Man-in-the-Middle attacks and potentially complete container compromise. Affected versions: ...

Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to machine-in-the-middle due to golang.org/x/crypto ( CVE-2023-48795 )

Summary Golang.org/x/crypto is used by IBM Cloud Pak for Data Scheduling as part of the scheduler binaries . CVE-2023-48795. Vulnerability Details CVEID:CVE-2023-48795 DESCRIPTION: OpenSSH is vulnerable to a machine-in-the-middle attack, caused by a flaw in the extension negotiation process in th...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a machine-in-the-middle vulnerability (CVE-2023-48795)

Summary OpenSSH is vulnerable to a machine-in-the-middle attack, caused by a flaw in the extension negotiation process in the SSH transport protocol when used with certain OpenSSH extensions. A remote attacker could exploit this vulnerability to launch a machine-in-the-middle attack and strip an...

the-heidelberg.de Cross Site Scripting vulnerability OBB-3916471

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-27990

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20...