Aggregator

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders. [...]

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Smart Licensing Utility flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Smart Licensing Utility vulnerability, tracked as CVE-2024-20439, to its Known Exploited Vulnerabilities (KEV) catalog. Last week, Cisco disclosed two vulnerabilities in its Smart Licensing Utility: CVE-2024-20439, […]

A vulnerability has been found in Webpushr Plugin up to 4.35.0 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-34369. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Rara Theme Restaurant and Cafe Plugin up to 1.2.1 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2024-34379. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability has been found in SliceWP Plugin up to 1.1.10 on WordPress and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-34413. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in YzmCMS 7.0 and classified as problematic. This issue affects some unknown processing of the component Ads Management/Carousel Management/System Settings. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2024-28725. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Popup Box Plugin up to 4.1.2 on WordPress. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-34367. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Asus RT-AC51U up to 3.0.0.4.380.8591. This issue affects some unknown processing. The manipulation of the argument WPA Pre-Shared Key leads to cross site scripting. The identification of this vulnerability is CVE-2023-33548. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Drupal Wiki 8.30/8.31.0. It has been declared as problematic. This vulnerability affects unknown code of the component Page Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-34481. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Уязвимость в WebKit позволяла полностью захватить контроль над iPhone.

In a recent revelation by SEQRITE Labs, a highly sophisticated cyber-espionage campaign, dubbed Operation HollowQuill, has been uncovered. The operation targets academic, governmental, and defense-related networks in Russia using weaponized decoy PDFs to deliver Cobalt Strike malware implants. The campaign appears to focus on infiltrating critical institutions such as the Baltic State Technical University (BSTU […]

The post Operation HollowQuill – Weaponized PDFs Deliver a Cobalt Strike Malware Into Gov & Military Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Currently trending CVE - Hype Score: 8 - The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for ...

Currently trending CVE - Hype Score: 9 - An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

A new wave of cyberattacks orchestrated by the advanced persistent threat (APT) group Earth Alux has been uncovered, revealing the use of sophisticated malware, including the VARGEIT backdoor, to infiltrate critical industries. Linked to China, Earth Alux has been targeting organizations across the Asia-Pacific (APAC) region and Latin America since 2023, focusing on sectors such […]

The post Earth Alux Hackers Use VARGIET Malware to Target Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The term “Lazarus Group,” once used to describe a singular Advanced Persistent Threat (APT) actor, has evolved to represent a complex network of sub-groups operating under shared objectives and tactics. This shift reflects the growing scale and diversification of their cyber activities, making traditional classifications increasingly obsolete. Security analysts now argue that “Lazarus” serves as […]

The post “Lazarus Hackers Group” No Longer Refer to a Single APT Group But a Collection of Many Sub-Groups appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SQL Windows Functions Comprehensive Cheatsheet

A vulnerability was found in ownCloud up to 4.5.6. It has been classified as critical. This affects an unknown part. The manipulation leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2013-0300. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in ownCloud up to 4.0.11. It has been declared as critical. This vulnerability affects unknown code. The manipulation of the argument timezone leads to cross-site request forgery. This vulnerability was named CVE-2013-0301. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.