WordPress Media Library Tools plugin < 1.5.0 - Author+ Stored XSS via SVG vulnerability

Author+ Stored XSS via SVG vulnerability discovered by Bob Matyas in WordPress Plugin Media Library Tools versions 1.5.0...

CVE-2024-50274

In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpfgetlinkksettings When the device control plane is removed or the platform running device control plane is rebooted, a reset is detected on the driver. On driver reset, it releases the resources and...

A Bag of RATs: VenomRAT vs. AsyncRAT

Introduction Remote access tools RATs have long been a favorite tool for cyber attackers, since they enable remote control over compromised systems and facilitate data theft, espionage, and continuous monitoring of victims. Among the well-known RATs are VenomRAT and AsyncRAT. These are open-sourc...

Cyber Story Time: The Boy Who Cried "Secure!"

As a relatively new security category, many security operators and executives I've met have asked us "What are these Automated Security Validation ASV tools?" We've covered that pretty extensively in the past, so today, instead of covering the "What is ASV?" I wanted to address the "Why ASV?"...

CVE-2024-10482 Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG

The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-10482

CVE-2024-10482 affects the WordPress plugin Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO (Media Library Tools). Prior to version 1.5.0, it failed to sanitize uploaded SVG files, allowing stored cross-site scripting (XSS) payloads by users with as little as Author...

CVE-2024-10482 Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG

The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

Adobe Audition Buffer Overflow Vulnerability (CNVD-2024-46402)

Adobe Audition is a set of multi-track editing tools from the American company Audobee Adobe. The product mainly uses a comprehensive toolset that includes multi-track, waveform and spectral display to mix, edit and create audio content. Adobe Audition suffers from a buffer overflow vulnerability...

openSUSE Security Advisory (SUSE-SU-2024:4011-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in eslint-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe353013f0da7eb67305f05b8a3b0db6e1dd3cd40ef4cc4a7bfc21029b380cf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10847 Malicious code in eslint-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe353013f0da7eb67305f05b8a3b0db6e1dd3cd40ef4cc4a7bfc21029b380cf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Tailored Tools plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by CTRL - Chance Patchstack Alliance in WordPress Plugin Tailored Tools versions = 1.8.4...

Microsoft Launches Windows Resiliency Initiative to Boost Security and System Integrity

Microsoft has announced a new Windows Resiliency Initiative as a way to improve security and reliability, as well as ensure that system integrity is not compromised. The idea, the tech giant said, is to avoid incidents like that of CrowdStrike's earlier this July, enable more apps and users to be...

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks

A new China-linked cyber espionage group has been attributed as behind a series of targeted cyber attacks targeting telecommunications entities in South Asia and Africa since at least 2020 with the goal of enabling intelligence collection. Cybersecurity company CrowdStrike is tracking the adversa...

WordPress Tailored Tools Plugin <= 1.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Tailored Tools Type Plugin Vulnerable versions = 1.8.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52503 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0da9a28c2169 Credits CTRL Chance Required privilege Contributo...

CVE-2024-51640

Cross-Site Request Forgery CSRF vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through = 1.1...

CVE-2024-51640 WordPress MDR Webmaster Tools plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through = 1.1...

CVE-2024-51640 WordPress MDR Webmaster Tools plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through = 1.1...

CVE-2024-51640

CVE-2024-51640 is a CSRF-to-Stored-XSS vulnerability in the WordPress plugin MDR Webmaster Tools (WordPress MDR Webmaster Tools) affecting versions n/a through 1.1. The vulnerability is triggered by Cross-Site Request Forgery which can lead to Stored XSS when an attacker causes a victim to perfor...

CVE-2024-50274

In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpfgetlinkksettings When the device control plane is removed or the platform running device control plane is rebooted, a reset is detected on the driver. On driver reset, it releases the resources and...