‼ CVE-2023-45062 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <=Â 2.4.6 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5621 ‼
📖 Read
via "National Vulnerability Database".
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-45008 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <=Â 1.0.3 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25476 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3254 ‼
📖 Read
via "National Vulnerability Database".
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4938 ‼
📖 Read
via "National Vulnerability Database".
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5632 ‼
📖 Read
via "National Vulnerability Database".
In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42319 ‼
📖 Read
via "National Vulnerability Database".
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45056 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <=Â 1.3.26 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45059 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <=Â 3.1.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45054 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <=Â 2.5 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45064 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <=Â 0.3.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5538 ‼
📖 Read
via "National Vulnerability Database".
The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45049 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <=Â 4.6.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45057 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <=Â 5.86 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45727 ‼
📖 Read
via "National Vulnerability Database".
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.📖 Read
via "National Vulnerability Database".
🕴 Data Security and Collaboration in the Modern Enterprise 🕴
📖 Read
via "Dark Reading".
The CISO Survival Guide explores the complex and shifting challenges, perceptions, and innovations that will shape how organizations securely expand in the future.📖 Read
via "Dark Reading".
Dark Reading
Data Security and Collaboration in the Modern Enterprise
The "CISO Survival Guide" explores the complex and shifting challenges, perceptions, and innovations that will shape how organizations securely expand in the future.
🕴 Israeli Cybersecurity Startups: Impact of a Growing Conflict 🕴
📖 Read
via "Dark Reading".
For Israeli startups and those closely linked to the country, the deepening crisis in the Middle East following the deadly Hamas attacks of Oct. 7 pose a fraught mix of complications. 📖 Read
via "Dark Reading".
Dark Reading
Israeli Cybersecurity Startups: Impact of a Growing Conflict
For Israeli startups and those closely linked to the country, the deepening crisis in the Middle East following the deadly Hamas attacks of Oct. 7 pose a fraught mix of complications.
🕴 Pro-Iranian Hacktivists Set Sights on Israeli Industrial Control Systems 🕴
📖 Read
via "Dark Reading".
The hacktivists known as SiegedSec identify ICS targets, but there's no evidence of attacks yet.📖 Read
via "Dark Reading".
Dark Reading
Pro-Iranian Hacktivists Set Sights on Israeli Industrial Control Systems
The hacktivists known as SiegedSec identify ICS targets, but there's no evidence of attacks yet.
🕴 The Need for a Cybersecurity-Centric Business Culture 🕴
📖 Read
via "Dark Reading".
Building a culture of cybersecurity is achievable by acknowledging its importance and consistently reinforcing that message.📖 Read
via "Dark Reading".
Dark Reading
The Need for a Cybersecurity-Centric Business Culture
Building a culture of cybersecurity is achievable by acknowledging its importance and consistently reinforcing that message.
♟️ The Fake Browser Update Scam Gets a Makeover ♟️
📖 Read
via "Krebs on Security".
One of the oldest malware tricks in the book -- hacked websites claiming visitors need to update their Web browser before they can view any content -- has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain.📖 Read
via "Krebs on Security".
Krebs on Security
The Fake Browser Update Scam Gets a Makeover
One of the oldest malware tricks in the book -- hacked websites claiming visitors need to update their Web browser before they can view any content -- has roared back to life in the past few months. New research shows…