Aggregator

A vulnerability, which was classified as problematic, has been found in WP Project Manager Plugin up to 2.6.14 on WordPress. This issue affects some unknown processing of the component Task Handler. The manipulation leads to missing authorization. The identification of this vulnerability is CVE-2024-10520. The attack may be initiated remotely. There is no exploit available.

Threat actors are increasingly banking on a new technique that leverages near-field communication (NFC) to cash out victim's funds at scale. The technique, codenamed Ghost Tap by ThreatFabric, enables cybercriminals to cash-out money from stolen credit cards linked to mobile payment services such as Google Pay or Apple Pay and relaying NFC traffic. "Criminals can now misuse Google Pay and Apple

In today’s rapidly evolving digital landscape, ensuring the security of your software supply chain is more critical than ever. At ReversingLabs, we are excited to announce our latest integration with ServiceNow, designed to provide comprehensive Software Bill of Materials (SBOM) management and enhance your security operations. As a member of the ServiceNow Partner Program, ReversingLabs is dedicated to driving innovative solutions. The ServiceNow Partner Program is designed to foster collaboration and innovation among its partners. Building partnerships is a vital component of the Partner Program, which enables build partners like Reversinglabs to develop and integrate applications on the Now Platform.

The post Strengthening Supply Chains: ReversingLabs Now Integrates with ServiceNow appeared first on Security Boulevard.

“智能助理+智能检测+智能治理”一体化风险治理闭环

Как создаются обширные вредоносные сети на десятки тысяч IoT-девайсов?

微软于 11 月 20 日释出了《微软飞行模拟 2024》。在 Steam 平台玩家留下了“差评如潮”的评价，Xbox 玩家也留下了 2/5 星的评分。相比《微软飞行模拟 2020》可选择下载不同地区地图离线游戏，新版本减少了容量，改为强制性的通过微软 Azure 云服务在线串流数据，结果玩家在开始游戏时遭遇了各种问题。微软会继续支持《微软飞行模拟 2020》，而玩家在前作中购买的飞机或机场可以带到新版中，每游戏一小时玩家大约需要串流 5GB 左右的数据，新版改进了动物的反应行为，羊会避雨，鸟会迁徙，大象会注意你的飞行。

CrowdStrike unveiled a new Chinese-aligned hacking group allegedly spying on telecom providers

A vulnerability was found in Django CMS Attributes Fields up to 3.x. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-11406. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in UserPlus Plugin up to 2.0 on WordPress and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to incorrect privilege assignment. This vulnerability is handled as CVE-2024-52442. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Buying Buddy IDX CRM Plugin up to 1.1.12 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2024-52446. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Saul Morales Pacheco Banner System Plugin up to 1.0.0 on WordPress. This issue affects some unknown processing. The manipulation leads to missing authentication. The identification of this vulnerability is CVE-2024-52437. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Aaron Robbins Post Ideas Plugin up to 2 on WordPress. Affected is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-52451. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as critical has been found in deco.agency de:branding Plugin up to 1.0.2 on WordPress. This affects an unknown part. The manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-2024-52438. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in Django Filer up to 3.2. This vulnerability affects unknown code of the component Upload. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-11404. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Corporate Zen Contact Page with Google Map Plugin up to 1.6.1 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to path traversal: '.../...//'. This vulnerability is handled as CVE-2024-52447. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in WPOPAL Opal Woo Custom Product Variation Plugin up to 1.1.3 on WordPress. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to path traversal. This vulnerability is known as CVE-2024-52444. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Official Pro Coders nBlocks Plugin up to 1.0.2 on WordPress. It has been classified as problematic. Affected is an unknown function. The manipulation leads to improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is traded as CVE-2024-52450. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Bueno Labs Xpresslane Fast Checkout Plugin up to 1.0.0 on WordPress and classified as critical. This issue affects some unknown processing. The manipulation leads to deserialization. The identification of this vulnerability is CVE-2024-52440. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Mark O'Donnell Team Rosters Plugin up to 4.6 on WordPress. This affects an unknown part. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2024-52439. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability has been found in Nerijus Masikonis Geolocator Plugin up to 1.1 on WordPress and classified as critical. This vulnerability affects unknown code. The manipulation leads to deserialization. This vulnerability was named CVE-2024-52443. The attack can be initiated remotely. There is no exploit available.