📢 Business email compromise attack costs far exceeding ransomware losses 📢
📖 Read
via "ITPro".
The increasingly popular phishing attack method is enabling threat actors to reap serious financial rewards 📖 Read
via "ITPro".
ITPro
Business email compromise attack costs far exceeding ransomware losses
The increasingly popular phishing attack method is enabling threat actors to reap serious financial rewards
‼ CVE-2023-30473 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov YML for Yandex Market plugin <=Â 3.10.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30784 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <=Â 1.5.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30782 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <=Â 3.7.5 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30871 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <=Â 1.1.0 versions.📖 Read
via "National Vulnerability Database".
🕴 Mandiant Releases Scanner to Identify Compromised NetScaler ADC, Gateways 🕴
📖 Read
via "Dark Reading".
Mandiant's IoC Scanner will help enterprises collect indicators of compromise on affected Citrix NetScaler products.📖 Read
via "Dark Reading".
Dark Reading
Mandiant Releases Scanner to Identify Compromised NetScaler ADC, Gateway
Mandiant's IoC Scanner will help enterprises collect indicators of compromise on affected Citrix NetScaler products.
‼ CVE-2023-30779 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <=Â 1.5.51 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30785 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <=Â 1.21 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4241 ‼
📖 Read
via "National Vulnerability Database".
lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30786 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <=Â 1.3.3 versions.📖 Read
via "National Vulnerability Database".
🕴 QR Code Phishing Campaign Targets Top US Energy Company 🕴
📖 Read
via "Dark Reading".
Attackers sent more than 1,000 emails with 2FA, MFA, and other security-related lures aimed at stealing Microsoft credentials.📖 Read
via "Dark Reading".
Dark Reading
QR Code Phishing Campaign Targets Top US Energy Company
Attackers sent more than 1,000 emails with 2FA, MFA, and other security-related lures aimed at stealing Microsoft credentials.
🕴 Iran and the Rise of Cyber-Enabled Influence Operations 🕴
📖 Read
via "Dark Reading".
Iranian threat actors are combining offensive network ops with messaging and amplification to manipulate targets' perceptions and behavior. Here are three examples.📖 Read
via "Dark Reading".
Dark Reading
Iran and the Rise of Cyber-Enabled Influence Operations
Iranian threat actors are combining offensive network ops with messaging and amplification to manipulate targets' perceptions and behavior. Here are three examples.
🕴 Boards Don't Want Security Promises — They Want Action 🕴
📖 Read
via "Dark Reading".
CISOs must demonstrate that security processes and updates reduce risk in measurable ways. Put emphasis on action, get the basics right, and improve processes. 📖 Read
via "Dark Reading".
Dark Reading
Boards Don't Want Security Promises — They Want Action
CISOs must demonstrate that security processes and updates reduce risk in measurable ways. Put emphasis on action, get the basics right, and improve processes.
‼ CVE-2023-32494 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local privileged attacker could potentially exploit this vulnerability, leading to elevation of privilege and affect in compliance mode also.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4782 ‼
📖 Read
via "National Vulnerability Database".
The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2271 ‼
📖 Read
via "National Vulnerability Database".
The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1977 ‼
📖 Read
via "National Vulnerability Database".
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4381 ‼
📖 Read
via "National Vulnerability Database".
Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0274 ‼
📖 Read
via "National Vulnerability Database".
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0058 ‼
📖 Read
via "National Vulnerability Database".
The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0551 ‼
📖 Read
via "National Vulnerability Database".
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments📖 Read
via "National Vulnerability Database".