Cybersecurity News Aggregator | CyberSecurityBoard

Latest Cyber News

Hackers Turned Visual Studio Code As A Remote Access Tool - After successfully intercepting the exfiltrated data the threat actors exploit unauthorized access through GitHub’s authentication system by navigating to “hxxps://github[.]com/login/device” and utilizing stolen alphanumeric ...
1 week ago Cybersecuritynews.com

Iranian APT Facilitating Remote Access To Target Networks - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from TuxCare authored by Wajahat Raja. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

CentOS vs Ubuntu: Enterprise Linux Comparison - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from TuxCare authored by Rohan Timalsina. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

Prince Ransomware Hits UK and US via Royal Mail Phishing Scam - The ransomware encrypts files on the victim’s computer, adding the “.womp” extension, and displays a ransom note demanding payment in Bitcoin for decryption. The attack, known as the “Prince Ransomware,” utilizes a ...
1 week ago Gbhackers.com

SIEM agent being used in SilentCryptoMiner attacks | Securelist - The most interesting action in this attack was the implementation of unusual techniques like using an SIEM agent as backdoor, adding the malicious payload to a legitimate digital signature, and hiding directories containing malicious files. The ...
1 week ago Securelist.com

ExpressVPN Review (2024): Pricing, Features, Pros, & Cons - You can unsubscribe at any ...
1 week ago Techrepublic.com

Microsoft and DOJ seized the attack infrastructure used by Russia-linked Callisto Group - Today, the United States District Court for the District of Columbia unsealed a civil action brought by Microsoft’s DCU, including its order authorizing Microsoft to seize 66 unique domains used by Star Blizzard in cyberattacks targeting Microsoft ...
1 week ago Securityaffairs.com

Cloud Penetration Testing Checklist - 2023 - Check the Service Level Agreement and make sure that proper policy has been covered between the Cloud service provider (CSP) and Client. Cloud penetration testing focuses on identifying and exploiting vulnerabilities in cloud environments, ensuring ...
1 week ago Gbhackers.com

Microsoft, DOJ Dismantle Domains Used by Russian FSB-Linked Hacking Group - By taking decisive action against Star Blizzard, Microsoft and its partners reinforce international norms and demonstrate a commitment to protecting civil society and upholding the rule of law in cyberspace. Between January 2023 and August 2024, Star ...
1 week ago Gbhackers.com

Microsoft Takes Unprecedented Action Against Cyber Threat Actor Star Blizzard - Cybersecurity Insiders - In a historic move that underscores the escalating battle against cybercrime, Microsoft has publicly acknowledged its role in launching a cyber offensive against a Russian-funded threat actor known as Star Blizzard. According to Microsoft’s ...
1 week ago Cybersecurity-insiders.com

Linux Malware perfctl Attacking Millions of Linux Servers - By combining elements from standard Linux tools like “perf” (a performance monitoring tool) and “ctl” (indicating control), the malware authors have crafted a seemingly innocuous name that masks its malicious intent. ...
1 week ago Gbhackers.com

Cybersecurity Today: National Vulnerability Database backlog, update on CIRA study: Cyber Security Today for Friday, October 4, 2024 - Updates on the latest cyber security threats to businesses, data breach disclosures, and how you can secure your firm in an increasingly risky time. Updates on the latest cybersecurity threats to businesses, data breach disclosures, and how you can ...
1 week ago Cybersecuritytoday.libsyn.com

Black Kite Research Reveals 80% Of Manufacturing Companies Face Critical Cyber Vulnerabilities - Due to its critical nature, the manufacturing industry is a prime target for bad actors to exploit, said Ferhat Dikbiyik, Black Kite’s chief research and intelligence officer. Black Kite’s data reveals that manufacturing was the top industry ...
1 week ago Informationsecuritybuzz.com

Strengthening Security Posture Through People-First Engagement - Regular, small doses of security education help combat the “forgetting curve,” a theory developed by Hermann Ebbinghaus that suggests people forget 75% of newly learned information within a couple of days. These statistics underscore a critical ...
1 week ago Informationsecuritybuzz.com

October 2024 Patch Tuesday forecast: Recall can be recalled - Help Net Security - The monthly cumulative updates, or ‘differentials’ from the checkpoint update, as Microsoft calls them, will begin anew in the form of much smaller files. Now available for systems that meet the hardware requirements, it includes many new ...
1 week ago Helpnetsecurity.com

E-Commerce Protection Lags Behind: Insights from the 2024 Global Bot Security Report - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from DataDome authored by Kira Lempereur. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

California's Deepfake Regulation: Navigating the Minefield of AI, Free Speech, and Election Integrity - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from Meet the Tech Entrepreneur, Cybersecurity Author, and Researcher authored by Deepak Gupta - Tech Entrepreneur, Cybersecurity Author. ...
1 week ago Securityboulevard.com

Best practices for implementing threat exposure management, reducing cyber risk exposure - Help Net Security - By identifying misconfigurations in technical security controls and correlating them with asset, vulnerability, and exposure data from integrated assessment sources, organizations gain an understanding of their security landscape. By systematically ...
1 week ago Helpnetsecurity.com

MaLDAPtive: Open-source framework for LDAP SearchFilter parsing, obfuscation, and more! - Help Net Security - MaLDAPtive is an open-source framework for LDAP SearchFilter parsing, obfuscation, deobfuscation, and detection. Complementing this is a PowerShell wrapper, crafted for flexibility and randomization, with pipeline capabilities that allow seamless ...
1 week ago Helpnetsecurity.com

Cybercriminals capitalize on poorly configured cloud environments - Help Net Security - However, mature threat actors are learning how to overcome obstacles — like leveraging inherent vulnerabilities in privileged device drivers for Windows to disable EDR sensors, injecting into privileged processes to delete critical security logs, ...
1 week ago Helpnetsecurity.com

New infosec products of the week: October 4, 2024 - Help Net Security - It also makes it possible to create effective security controls that keep a business’ most sensitive data safe from becoming a data security risk (e.g. revoking public access to files marked ‘confidential’). The Legit Posture Score sets a new, ...
1 week ago Helpnetsecurity.com

New Perfctl Malware Attacking Millions of Linux Servers - The Perfctl malware represents a significant threat to Linux servers worldwide, emphasizing the need for robust security measures and vigilant monitoring. Mitigation strategies include patching vulnerabilities, restricting file execution in writable ...
1 week ago Cybersecuritynews.com

DPRK's APT37 Targets Cambodia in Khmer - The North Korean state-sponsored threat actor known as APT37 has been carefully spreading a novel backdoor, dubbed "VeilShell." Of note is its target: Most North Korean advanced persistent threats (APTs) have a history of targeting ...
1 week ago Darkreading.com

Exposing the Credential Stuffing Ecosystem - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from Kasada authored by Nick Rieniets. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

Dutch police breached by a state actor - “The police have been informed by the intelligence services that it is very likely a ‘state actor’, in other words: another country or perpetrators on behalf of another country.” reads the update on the data breach published ...
1 week ago Securityaffairs.com

USENIX NSDI '24 -LiFteR: Unleash Learned Codecs in Video Streaming with Loose Frame Referencing - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from Infosecurity.US authored by Marc Handelman. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

Recently patched CUPS flaw can be used to amplify DDoS attacks - As Akamai security researchers found, a CVE-2024-47176 security flaw in the cups-browsed daemon that can be chained with three other bugs to gain remote code execution on Unix-like systems via a single UDP packet can also be leveraged to ...
1 week ago Bleepingcomputer.com

DrayTek Routers at Risk From 14 New Vulnerabilities - The advice comes amid signs of growing threat actor activity — including by nation-state actors — targeting vulnerabilities in routers and other network devices from DrayTek and a variety of other vendors, including Fortinet, F5, QNAP, Ivanti, ...
1 week ago Darkreading.com

Understanding the Dependency Injection Lifecycle - DZone - public class ClassD { // other implementation // Below code will update the value of callMeScoped to "I am from ClassA" for the instance of ClassA // But as it is Scoped life cycle so it is holding single instance ScopedImplementation of // Then it ...
1 week ago Feeds.dzone.com

3thix partners with Avalanche on web3 gaming ad data | VentureBeat - Coming up October 28th and 29th, join fellow leaders and amazing speakers like Matthew Bromberg (CEO Unity), Amy Hennig (Co-President of New Media Skydance Games), Laura Naviaux Sturr (GM Operations Amazon Games), Amir Satvat (Business Development ...
1 week ago Venturebeat.com

Make Cybersecurity Awareness Month a Game-Changer for You and Your Career - Cisco Blogs - Whether you’re a seasoned network engineer or just starting out, let Cisco Learning & Certifications help you to become your organization’s cybersecurity superstar starting with our Cisco Cybersecurity Training and Certification Giveaway. ...
1 week ago Feedpress.me

CISA Adds High-Severity Ivanti Vuln to KEV Catalog - "Exploiting this flaw could have serious consequences, such as data breaches, disruption of business operations, and further compromise of internal systems," Eric Schwake, director of cybersecurity strategy at Salt Security, wrote in an ...
1 week ago Darkreading.com

Ukraine-Russia Cyber Battles Have Real-World Impact - "The evolution of cyberattacks and malware, particularly those that have an intersection with the use of generative AI, have lowered the barrier for entry for threat actors, leading to more threats and a greater volume of attacks," he says. ...
1 week ago Darkreading.com

A Leader in 2024 Forrester Enterprise Firewall Solutions Wave - Palo Alto Networks has long recognized these challenges, which is why we’ve built a network security platform that not only protects but also fosters business growth and innovation in today’s complex environment. We believe the recognition of ...
1 week ago Paloaltonetworks.com

‘Pig butchering’ trading apps found on Google Play, App Store - Group-IB also warns that the UniShadow Trade apps can mimick a variety of legitimate cryptocurrency and trading platforms, providing the following extensive list with potential names that could be used in impersonation attempts. Fake trading ...
1 week ago Bleepingcomputer.com

Microsoft SFI progress report elicits cautious optimism | TechTarget - "After a year, it looks like Microsoft has made some smart and substantive initial progress in elevating security across the whole organization: investment in security-focused head count, inclusion of security into performance reports across the ...
1 week ago Techtarget.com

News alert: SquareX shows how Google’s MV3 standard falls short, putting millions at risk - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from The Last Watchdog authored by cybernewswire. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

News alert: Doppler fortifies ‘secrets management’ with Change Requests auditable approval feature - Security Boulevard - *** This is a Security Bloggers Network syndicated blog from The Last Watchdog authored by cybernewswire. Copyright © 2024 Techstrong Group Inc. ...
1 week ago Securityboulevard.com

Detroit-area government services impacted by cyberattack - Corrections officers within the Wayne County Sheriff’s Office have struggled to process inmates, the Wayne County Treasurer’s Office has had issues collecting taxes online and the Wayne County Register of Deeds Office closed early on Wednesday, ...
1 week ago Therecord.media

Microsoft security overhaul offers blueprint for SecOps | TechTarget - 23, nearly a year after Microsoft kicked off the initiative in response to a scathing report from the U.S. Department of Homeland Security's Cyber Safety Review Board about a "cascade of security failures" that led to a breach of email systems ...
1 week ago Techtarget.com

Dutch Police: ‘State actor’ likely behind recent data breach - Based on the intelligence services' information, the police immediately implemented strong security measures to counter this attack. The national Dutch police (Politie) says that a state actor was likely behind the data breach it detected last week. ...
1 week ago Bleepingcomputer.com

Tesla Recalls 27,00 Cybertrucks Over Rear Camera | Silicon UK - CNBC reported that Tesla said on Thursday it would recall more than 27,000 Cybertrucks due to delayed rear-view camera images that could impair driver visibility and increase crash risks. CNBC reported that Tesla said on Thursday that the ...
1 week ago Silicon.co.uk

Voting for the first time—4 cybersecurity tips for new voters - Here’s a quick checklist for first-time voters and tips to help them keep their personal information safe this election cycle. Whether you're excited or just trying to get through it, there are a few things you’ll want to know—not just about ...
1 week ago Blog.avast.com

You don't need to pay for antivirus software - here's why | ZDNET - As for Windows? Well, Microsoft Defender Antivirus, which is included with every Windows PC, routinely aced the tests from third-party labs that measure the effectiveness of security software. Older Americans are significantly more likely to use ...
1 week ago Zdnet.com

The Future of AI Safety: What California's Vetoed Bill Means - Although the veto was a setback for the bill, it highlights key debates in the emerging field of AI governance and the potential for California to shape the future of AI regulation. With the rapid advancement of AI technology, California's ...
1 week ago Darkreading.com

Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure - Microsoft and the Justice Department have seized over 100 domains used by the Russian ColdRiver hacking group to target United States government employees and nonprofit organizations from Russia and worldwide in spear-phishing attacks. "Between ...
1 week ago Bleepingcomputer.com

Browser Firms Press EU To Reconsider Microsoft Edge | Silicon UK - Reuters reported that the letter to the European Commission was from Vivaldi, Waterfox, Wavebox and the Open Web Advocacy, and it alleges that Microsoft gives its Edge browser an unfair advantage. Reuters noted that the letter could bolster Norwegian ...
1 week ago Silicon.co.uk

New Linux Malware 'Perfctl' Targets Millions by Mimicking System Files - To protect your Linux systems from Perfctl, regularly update your operating system and software with the latest security patches, conduct vulnerability assessments, implement robust network security measures like firewalls and intrusion detection ...
1 week ago Hackread.com

Over 4,000 Adobe Commerce, Magento shops hacked in CosmicSting attacks - Website security company Sansec has been tracking the attacks since June 2024 and observed 4,275 stores breached in CosmicSting attacks, high-profile victims including Whirlpool, Ray-Ban, National Geographic, Segway, and Cisco, which ...
1 week ago Bleepingcomputer.com

The 6 Best Email Security Software & Tools of 2024 - To guarantee full protection against email threats, important features to consider when picking an email security solution include email filtering and spam detection, sandboxing, mobile support, advanced machine learning, and data loss prevention. ...
1 week ago Esecurityplanet.com

How To Collect Malware Indicators Of Compromise In The ANY.RUN Sandbox - The sandbox captures various types of IOCs like “network communications,” “file system changes,” “registry modifications,” and “process behaviors,” enabling thorough threat assessment. The ANY.RUN ...
1 week ago Cybersecuritynews.com

Microsoft Invests €4.3 Billion In Italy For AI, Cloud | Silicon UK - Microsoft said that it’s data centre expansion in Northern Italy coupled with its commitment to provide extensive AI skills training, supports the rising demand for AI compute and cloud services across Italy as organisations look to boost ...
1 week ago Silicon.co.uk

'Defunct' DOJ ransomware task force raises questions, concerns | TechTarget - "The Office of the Deputy Attorney General (ODAG) memorandum that established the Ransomware Task Force also contained several strategic areas, including directing the Ransomware Task Force to design and implement a strategy to disrupt and dismantle ...
1 week ago Techtarget.com

Celebrating Latin and Hispanic Heritage Month - Cisco Blogs - While LHHM gives us a special opportunity to celebrate our culture, WE should continually uplift our community, honor our traditions, and show respect for other cultures, ensuring that the values of unity and diversity remain at the forefront of our ...
1 week ago Feedpress.me

Customer compliance and security during the post-quantum cryptographic migration | AWS Security Blog - For example, using the s2n-tls client built with AWS-LC (which supports the quantum-resistant KEMs), you could try connecting to a Secrets Manager endpoint by using a post-quantum TLS policy (for example, PQ-TLS-1-2-2023-12-15) and observe the PQ ...
1 week ago Aws.amazon.com

How Analysts Use Telegram API to Intercept Data Exfiltrated by Malware - To start the process of collecting threat actor’s Chat ID and bot token, the analysts found a relevant malware sample related to the domain “api.telegram.org” using ANY.RUN’s Threat Intelligence Lookup. The sandbox also allowed researchers to ...
1 week ago Cybersecuritynews.com

Cloudflare blocks largest recorded DDoS attack peaking at 3.8Tbps - Typically, threat actors launching DDoS attacks rely on large networks of infected devices (botnets) or look for ways to amplify the delivered data at the target, which requires a smaller number of systems. After scanning the public internet for ...
1 week ago Bleepingcomputer.com

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 23, 2024 to September 29, 2024) - Software Name Software Slug 012 Ps Multi Languages 012-ps-multi-languages ABC APP CREATOR abcapp-creator Absolute Reviews absolute-reviews Accordion accordions Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads quick-adsense-reloaded Advanced File ...
1 week ago Wordfence.com

One-Third of UK Teachers Do Not Have Cybersecurity Training - You can unsubscribe at any ...
1 week ago Techrepublic.com

The Secret Weakness Execs Are Overlooking: Non-Human Identities - By shifting our focus to secrets security and adopting a comprehensive approach that includes robust detection, automated remediation, and integration with identity systems, organizations can significantly reduce their attack surface and bolster ...
1 week ago Thehackernews.com

Operation Cronos extension on LockBit Ransomware and FIN7 Deepfake Malware - Cybersecurity Insiders - The European Union Agency for Law Enforcement Cooperation announced that additional arrests are anticipated in the coming weeks, as they have already compiled a list of individuals connected to the group, aiming to disrupt their operations and IT ...
1 week ago Cybersecurity-insiders.com

Celebrating Cisco’s Solutions Engineers in Honor of National Techies Day - Cisco Blogs - The solutions we create at Cisco deliver desired outcomes for partners and customers by providing the most comprehensive suite of products and services that support secure and flexible access to data and applications, optimize performance, and enable ...
1 week ago Feedpress.me

Thousands of Adobe Commerce e-stores hacked by exploiting CosmicSting bug - Sansec researchers reported that multiple threat actors have exploited a critical Adobe Commerce vulnerability, tracked as CVE-2024-34102 (aka CosmicSting, CVSS score of 9.8), to compromise more than 4,000 e-stores over the past three months. Over ...
1 week ago Securityaffairs.com

The Complete Guide to PAM Tools, Features, And Techniques - Before we can dig into specific PAM tools and techniques – it’s first helpful to discuss what effective privileged access management looks like. Privileged access management can’t exist in a silo, because hackers often rely on network/software ...
1 week ago Heimdalsecurity.com

Critical Ivanti Endpoint Manager flaw exploited (CVE-2024-29824) - Help Net Security - CVE-2024-29824, an unauthenticated SQL Injection vulnerability in Ivanti Endpoint Manager (EPM) appliances, is being exploited by attackers, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the bug to its Known Exploited ...
1 week ago Helpnetsecurity.com

Doppler Launches 'Change Requests' to Strengthen Secrets Management Security with Audited Approvals - Doppler, the leading platform in secrets management, today announces the launch of Change Requests, a new feature providing engineering teams with a secure, auditable approval process for managing and controlling secret changes across environments. ...
1 week ago Cybersecuritynews.com

UWA Innovates: Network Upgrade Transforms Student Experience, Boosts Security, and Drives Sustainability - Cisco Blogs - University of Western Australia (UWA) recognized that investment in its underlying network was a major lever to improve the student experience, automate the management of core functions and ensure university data was protected. Ensuring cybersecurity ...
1 week ago Feedpress.me

Doppler Launches 'Change Requests' to Strengthen Secrets Management Security with Audited Approvals - Cybersecurity Insiders - Doppler, the leading platform in secrets management, today announces the launch of Change Requests, a new feature providing engineering teams with a secure, auditable approval process for managing and controlling secret changes across environments. ...
1 week ago Cybersecurity-insiders.com

New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking - To mitigate the risk posed by perfctl, it's recommended to keep systems and all software up-to-date, restrict file execution, disable unused services, enforce network segmentation, and implement Role-Based Access Control (RBAC) to limit access to ...
1 week ago Thehackernews.com

Millions of Enterprises at Risk: SquareX Shows How Malicious Extensions Bypass Google’s MV3 Restrictions - Cybersecurity Insiders - This has made browser extensions a very effective and potent technique to silently be installed and monitor enterprise users, and attackers are leveraging them to monitor communication over web calls, act on the victim’s behalf to give permissions ...
1 week ago Cybersecurity-insiders.com

OpenText report raises awareness for consumer digital life protection as privacy concerns increase with generative AI use - Webroot Blog - Additionally, while consumers have taken steps to protect their personal information, only 27% use privacy tools and settings to protect workplace information when using generative AI. Consumers can better protect their sensitive information from ...
1 week ago Webroot.com

Trending Cyber News (last 7 days)

CVE-2024-47638 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & ...
6 days ago

CVE-2024-9314 - The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This ...
4 days ago

CVE-2024-9536 - A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /MultiServerBackService?path1. The manipulation of the argument fileId leads to sql injection. The attack ...
6 days ago

CVE-2024-9532 - A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to buffer ...
2 days ago

CVE-2024-47642 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 2.0.1. ...
6 days ago

CVE-2024-47647 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HelpieWP Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin allows Stored XSS.This issue affects Accordion & FAQ – ...
6 days ago

CVE-2024-47370 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.21. ...
6 days ago

CVE-2024-9550 - A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formLogDnsquery of the file /goform/formLogDnsquery. The manipulation of the argument curTime leads to buffer overflow. It is ...
2 days ago

CVE-2024-9557 - A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file /goform/formSetWanPPPoE. The manipulation of the argument webpage leads to buffer overflow. ...
5 days ago

CVE-2024-47643 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Alexander Böhm Include Fussball.De Widgets allows Stored XSS.This issue affects Include Fussball.De Widgets: from n/a through 4.0.0. ...
6 days ago

CVE-2024-47644 - Cross-Site Request Forgery (CSRF) vulnerability in Copyscape / Indigo Stream Technologies Copyscape Premium allows Stored XSS.This issue affects Copyscape Premium: from n/a through 1.3.6. ...
6 days ago

CVE-2024-47646 - URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payflex Payflex Payment Gateway.This issue affects Payflex Payment Gateway: from n/a through 2.6.1. ...
6 days ago

CVE-2024-9533 - A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The ...
2 days ago

CVE-2024-47384 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One] allows Reflected XSS.This issue affects WP Compress – Image Optimizer ...
6 days ago

CVE-2024-47369 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPWeb Social Auto Poster allows Reflected XSS.This issue affects Social Auto Poster: from n/a through 5.3.15. ...
6 days ago

CVE-2024-47377 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeKraft BuddyForms allows Stored XSS.This issue affects BuddyForms: from n/a through 2.8.12. ...
6 days ago

CVE-2024-47913 - An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to ...
4 days ago

CVE-2024-47309 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce allows PHP Local File Inclusion.This issue affects Cities Shipping Zones for WooCommerce: from n/a ...
4 days ago

CVE-2024-47630 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a ...
6 days ago

CVE-2024-47387 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LinkGraph Search Atlas SEO allows Stored XSS.This issue affects Search Atlas SEO: from n/a through 1.8.2. ...
6 days ago

CVE-2024-47623 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Gallery Lightbox allows Stored XSS.This issue affects Gallery Lightbox: from n/a through 1.0.0.39. ...
6 days ago

CVE-2024-47373 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 6.5.0.2. ...
6 days ago

CVE-2024-47374 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 6.5.0.2. ...
6 days ago

CVE-2024-47375 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ashraf XLTab – Accordions and Tabs for Elementor Page Builder allows Stored XSS.This issue affects XLTab – Accordions and Tabs ...
6 days ago

CVE-2024-47376 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Slideshow Gallery allows Stored XSS.This issue affects Slideshow Gallery: from n/a through 1.8.3. ...
6 days ago

CVE-2024-9549 - A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formEasySetupWizard/formEasySetupWizard2 of the file /goform/formEasySetupWizard. The manipulation of the argument curTime leads to ...
1 day ago

CVE-2024-8486 - The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in the Modern Heading and Icon Picker widgets all versions up to, and including, 2.16.3 due to ...
4 days ago

CVE-2024-47319 - Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form – Contact Form Plugin allows Code Injection.This issue affects Bit Form – Contact Form Plugin: from n/a through 2.13.10. ...
4 days ago

CVE-2024-47639 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VdoCipher allows Stored XSS.This issue affects VdoCipher: from n/a through 1.29. ...
6 days ago

CVE-2024-47635 - Cross-Site Request Forgery (CSRF) vulnerability in TinyPNG.This issue affects TinyPNG: from n/a through 3.4.3. ...
6 days ago

CVE-2024-47625 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.8. ...
6 days ago

CVE-2024-47627 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through 3.6.0. ...
6 days ago

CVE-2024-47628 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a ...
6 days ago

CVE-2024-9534 - A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. It ...
2 days ago

CVE-2024-47386 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – ...
6 days ago

CVE-2024-47388 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SliceWP allows Reflected XSS.This issue affects SliceWP: from n/a through 1.1.18. ...
6 days ago

CVE-2024-47390 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through 2.6.8. ...
6 days ago

CVE-2024-47372 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 3.1.0. ...
6 days ago

CVE-2024-47355 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.0.11. ...
5 days ago

CVE-2024-9563 - A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the file /goform/formWlanSetup_Wizard. The manipulation of the argument webpage leads to buffer ...
3 days ago

CVE-2024-20102 - In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ...
1 day ago

CVE-2024-44012 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through 1.1. ...
4 days ago

CVE-2024-44013 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through 2.4.0. ...
4 days ago

CVE-2024-44015 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Users Control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through 1.0.16. ...
4 days ago

CVE-2024-47629 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a ...
6 days ago

CVE-2024-47391 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a before 5.1.1. ...
6 days ago

CVE-2024-47394 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in eyecix JobSearch allows Reflected XSS.This issue affects JobSearch: from n/a through 2.5.9. ...
6 days ago

CVE-2024-45247 - Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect') ...
5 days ago

CVE-2024-9555 - A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. Affected by this issue is the function formSetEasy_Wizard of the file /goform/formSetEasy_Wizard. The manipulation of the argument curTime leads to ...
5 days ago

CVE-2024-9560 - A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is the function delCatelogs of the file /CDGServer3/document/Catelogs;logindojojs?commandDelCatelogs. The manipulation of the argument id leads to sql ...
4 days ago