PT-2023-8768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel's handling of uninitialized stack memory. Privileged programs are supposed to be able to read this memory, but before the patch, these accesses...

Cybersecurity considerations to have when shopping for holiday gifts

As I wrote about last week, there are holiday shopping-related scams already popping up all over the place. But another aspect of security that many shoppers dont consider this time of year is the security of the products theyre buying, even through a legitimate online marketplace. This is a...

PT-2024-14783

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns a flaw in the Linux kernel's BPF verifier, specifically with precision tracking for non-r10 register spill/fill to/from stack. This change aims to record instructions...

Debian dla-3680 : libopendkim-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3680 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3680-1 [email protected] https://www.debian.org/lts/security/...

OESA-2023-1859 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: An out-of-bounds read vulnerability was found in Netfilter Connection Tracking conntrack in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.CVE-2023-39197 A null pointer...

The vulnerability of Intradesk’s request tracking system arises from the lack of measures taken to protect its web page structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of Intradesk’s request tracking system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack remotely...

Meta sued over forcing users to pay to stop tracking

Meta is required to get users’ consent in Europe in order to show them targeted ads. For this reason, Meta has to provide European users with a way to opt out of behavioral advertising or face fines totalling $100,000 a day. Behavioral advertising are ads tailored to someone’s browsing habits and...

Stop Identity Attacks: Discover the Key to Early Threat Detection

Identity and Access Management IAM systems are a staple to ensure only authorized individuals or entities have access to specific resources in order to protect sensitive information and secure business assets. But did you know that today over 80% of attacks now involve identity, compromised...

Simple 301 Redirects < 2.0.8 - Cross-Site Request Forgery via 'clicked'

Description The Simple 301 Redirects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the 'clicked' function. This makes it possible for unauthenticated attackers to enable or disable...

Simple 301 Redirects by BetterLinks < 2.0.8 - Missing Authorization via clicked

Description The Simple 301 Redirects by BetterLinks plugin for WordPress is vulnerable to unauthorized enabling of plugin usage tracking due to a missing capability check on the clicked function in all versions up to, and including, 2.0.7. This makes it possible for subscribers to enable plugin...

Analytify Dashboard < 5.1.1 - Missing Authorization to Opt-In

Description The Analytify Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optinyes function in versions up to, and including, 5.1.0. This makes it possible for authenticated attackers, with subscriber-level and above acces...

FeedFocal <= 1.2.2 - Unauthenticated Tracking Code Update

Description The plugin is lacking authorisation checks in its feedfocalapisetup function, allowing unauthenticated attackers to update the Tracking Code via the feedfocalsurveycode option...

Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update

Description The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage function. This makes it possible for unauthenticated attackers to update the...

CallRail Phone Call Tracking < 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrailform' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'formid' user supplied attribute. This makes it...

CVE-2023-5715

The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2023-2889

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Veon Computer Service Tracking Software allows SQL Injection.This issue affects Service Tracking Software: before crm 2.0...

CVE-2023-2889

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Veon Computer Service Tracking Software allows SQL Injection. This issue affects Service Tracking Software: before crm 2.0...

CVE-2023-2889

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Veon Computer Service Tracking Software allows SQL Injection. This issue affects Service Tracking Software: before crm 2.0...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Veon Computer Service Tracking Software allows SQL Injection.This issue affects Service Tracking Software: before crm 2.0...

CVE-2023-2889 SQLi in Veon Computer's Service Tracking Software

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Veon Computer Service Tracking Software allows SQL Injection. This issue affects Service Tracking Software: before crm 2.0...