THREAT INTELLIGENCE · RESEARCH · COMMUNITY

Security news,
without the noise.

Practical coverage of vulnerabilities, emerging threats, and the tools shaping modern security.

Latest intelligence

404 articles

SECONE4ALL · CYBERSECURITYSep 28, 2024 · 11:07 AM · UTC · UTC+00:00

CVE-2024-8056: MM-Breaking News WordPress Plugin Reflected XSS Vulnerability

The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CYBERSECURITY

SECONE4ALL · CYBERSECURITYSep 28, 2024 · 09:28 AM · UTC · UTC+00:00

CVE-2024-47048: Rocket.Chat Stored XSS Vulnerability

A stored cross-site scripting (XSS) vulnerability was discovered in Rocket.Chat versions 6.12.0 and earlie

CYBERSECURITY

SECONE4ALL · CYBERSECURITYSep 25, 2024 · 08:28 AM · UTC · UTC+00:00

Exploit Title: Reflected XSS in Elaine's Realtime CRM Automation v6.18.17 CVE-2024-42831

A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser

CYBERSECURITY

SECONE4ALL · CYBERSECURITYSep 05, 2024 · 11:46 AM · UTC · UTC+00:00

CVE-2024-36401 (GeoServer RCE)

CVE-2024-36401 is a critical Remote Code Execution vulnerability in GeoServer, specifically targeting the Web Feature Service (WFS) endpoint. By sending a specially crafted GET request, an attacker can execute arbitrary Java code via the valueReference parameter of a WFS request. This allows attackers to run system-level commands remotely on the server.