Aggregator

拉尔夫·戈夫（Ralph Goff）在中央情报局工作了 35 年，曾 6 次担任站长，在欧洲、中东、中亚和南亚（包括几个战区）广泛服务。他曾担任欧洲和欧亚大陆的行动负责人。

A vulnerability was found in Brocade SANnav up to 2.3.0. It has been declared as problematic. This vulnerability affects unknown code of the component PostgreSQL. The manipulation leads to sensitive information in log files. This vulnerability was named CVE-2024-29955. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in bdthemes Element Pack Elementor Addons Plugin up to 5.6.0 on WordPress. Affected by this vulnerability is an unknown functionality of the component Price List Widget. The manipulation of the argument Link leads to cross site scripting. This vulnerability is known as CVE-2024-1426. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in bdthemes Element Pack Elementor Addons Plugin up to 5.6.0 on WordPress. Affected by this issue is some unknown functionality of the component Panel Slider Widget. The manipulation of the argument tab_link leads to cross site scripting. This vulnerability is handled as CVE-2024-1429. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Jobs Plugin up to 2.7.5 on WordPress and classified as problematic. This vulnerability affects unknown code of the component job-search. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-2833. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in EAN for WooCommerce up to 4.9.2 on WordPress. It has been classified as problematic. Affected is the function alg_wc_ean_product_meta of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2023-6892. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in extendWP Import Content in WordPress & WooCommerce with Excel Plugin up to 4.2 on WordPress. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-32585. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in Xylus Themes WordPress Importer Plugin up to 1.0.7 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-32597. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in SolarWinds Platform up to 2024.1. This issue affects some unknown processing of the component URL Parameter Handler. The manipulation leads to open redirect. The identification of this vulnerability is CVE-2024-28076. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability was found in SolarWinds Platform up to 2024.1 and classified as critical. Affected by this issue is some unknown functionality of the component SWQL Handler. The manipulation leads to sql injection. This vulnerability is handled as CVE-2024-29001. The attack needs to be done within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, was found in SolarWinds Platform up to 2024.1. Affected is an unknown function of the component Maps Section. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-29003. It is possible to launch the attack remotely. There is no exploit available.

Cybersecurity researchers have uncovered malicious libraries in the Python Package Index (PyPI) repository that are designed to steal sensitive information and test stolen credit card data. Two of the packages, bitcoinlibdbfix and bitcoinlib-dev, masquerade as fixes for recent issues detected in a legitimate Python module called bitcoinlib, according to ReversingLabs. A third package discovered

CEO Accused of Providing Misleading Revenue, Liquidity Numbers to Key Stakeholders
Financial statement fraud is once again making headlines. Fashion startup CaaStle has accused its co-founder and CEO, Christine Hunsicker, of serious financial misconduct, leading to her resignation. The incident could be one of the biggest cases of start-up fraud in recent years.

More Evidence Surfaces of Chinese Hackers Targeting Ivanti Products
A suspected Chinese cyberespionage operation is behind a spate of malware left on VPN appliances made by Ivanti. The threat actor used a critical security vulnerability the Utah company patched in February. "We are aware of a limited number of customers whose appliances have been exploited."

缪勒最后说了一句，不是我处无能，是导演太狡猾

缪勒最后说了一句，不是我处无能，是导演太狡猾

A recently discovered set of vulnerabilities, dubbed “IngressNightmare,” found in Ingress NGINX Controller, exposing clusters to unauthenticated remote code execution (RCE). Kubernetes dominates container orchestration, but its prominence has made it a target for exploitation. In Kubernetes, Ingress serves as a sophisticated traffic management system, enabling external access to internal services. It comprises two core […]

The post “IngressNightmare” Critical RCE Vulnerabilities in Kubernetes NGINX Clusters Let Attackers Gain Full Control appeared first on Cyber Security News.

Submit #551662 / VDB-282865