🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
🗓️ White House tackles ‘unique security challenges’ faced by open source ecosystem during dedicated virtual summit 🗓️

Silicon Valley giants joined government officials to thrash out remedies to software supply chain woes

📖 Read

via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
White House tackles ‘unique security challenges’ faced by open source ecosystem during dedicated virtual summit
Silicon Valley giants joined government officials to thrash out remedies to software supply chain woes
297 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25025 ‼

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

📖 Read

via "National Vulnerability Database".
247 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25024 ‼

The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues

📖 Read

via "National Vulnerability Database".
230 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25061 ‼

The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.

📖 Read

via "National Vulnerability Database".
223 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0253 ‼

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

📖 Read

via "National Vulnerability Database".
217 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-24909 ‼

The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue

📖 Read

via "National Vulnerability Database".
216 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25005 ‼

The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

📖 Read

via "National Vulnerability Database".
221 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-4164 ‼

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

📖 Read

via "National Vulnerability Database".
216 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-24838 ‼

The AnyComment WordPress plugin through 0.2.17 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.

📖 Read

via "National Vulnerability Database".
221 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25036 ‼

The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.

📖 Read

via "National Vulnerability Database".
220 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0240 ‼

mruby is vulnerable to NULL Pointer Dereference

📖 Read

via "National Vulnerability Database".
230 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25037 ‼

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).

📖 Read

via "National Vulnerability Database".
246 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25046 ‼

The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.

📖 Read

via "National Vulnerability Database".
264 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-3862 ‼

icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

📖 Read

via "National Vulnerability Database".
303 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25067 ‼

The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.

📖 Read

via "National Vulnerability Database".
310 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-25065 ‼

The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.

📖 Read

via "National Vulnerability Database".
327 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0256 ‼

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

📖 Read

via "National Vulnerability Database".
335 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0257 ‼

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

📖 Read

via "National Vulnerability Database".
346 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-0258 ‼

pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

📖 Read

via "National Vulnerability Database".
375 views
🛡 Cybersecurity & Privacy 🛡 - News
🗓️ Celebrations over REvil ransomware arrests in Russia may be premature 🗓️

‘It’s not clear whether the developers or lower-level criminals were arrested’, threat intel experts tell The Daily Swig

📖 Read

via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Celebrations over REvil ransomware arrests in Russia may be premature
‘It’s not clear whether the developers or lower-level criminals were arrested’, security experts tell The Daily Swig
431 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-38965 ‼

IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 212346.

📖 Read

via "National Vulnerability Database".
502 views