A vulnerability in VeronaLabs Slimstat Analytics wp-slimstat.This issue affects Slimstat Analytics: from n/a through <= 5.0.4. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile
A vulnerability in nucleusgenius Quasar form quasar-form.This issue affects Quasar form: from n/a through <= 6.0. CVSSv3.1 8.5 (HIGH) · EPSS 43th percentile
A vulnerability in smartypants SP Project & Document Manager sp-client-document-manager.This issue affects SP Project & Document Manager : from n/a through <= 4.67. CVSSv3.1 8.3 (HIGH) · EPSS 43th percentile
A vulnerability in Favethemes Houzez CRM houzez-crm.This issue affects Houzez CRM: from n/a through <= 1.3.4. CVSSv3.1 9.9 (CRITICAL) · EPSS 43th percentile
A vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 2.2.0. CVSSv3.1 8.1 (HIGH) · EPSS 48th percentile
A vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 2.1.10. CVSSv3.1 8.2 (HIGH) · EPSS 45th percentile
A vulnerability in gopiplus Email posts to subscribers email-posts-to-subscribers.This issue affects Email posts to subscribers: from n/a through <= 6.2. CVSSv3.1 8.2 (HIGH) · EPSS 43th percentile
A vulnerability in Be POPIA Compliant Be POPIA Compliant be-popia-compliant.This issue affects Be POPIA Compliant: from n/a through <= 1.2.0. CVSSv3.1 8.2 (HIGH) · EPSS 43th percentile
A vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar.This issue affects Spiffy Calendar: from n/a through <= 4.9.1. CVSSv3.1 8.5 (HIGH) · EPSS 51th percentile
A vulnerability in reputeinfosystems ARMember armember-membership.This issue affects ARMember: from n/a through <= 3.4.11. CVSSv3.1 8.2 (HIGH) · EPSS 43th percentile
A vulnerability in integrationdevpaytm Paytm Payment Gateway paytm-payments.This issue affects Paytm Payment Gateway: from n/a through <= 2.7.3. CVSSv3.1 8.2 (HIGH) · EPSS 97th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6. CVSSv3.1 8.2 (HIGH) · EPSS 89th percentile
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile
A vulnerability in weDevs WP Project Manager wedevs-project-manager.This issue affects WP Project Manager: from n/a through <= 2.6.0. CVSSv3.1 8.5 (HIGH) · EPSS 43th percentile
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. CVSSv3.1 8.6 (HIGH) · EPSS 100th percentile
An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file. CVSSv3.1 9.8 (CRITICAL) · EPSS 67th percentile
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101. CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of HTTPS requests. An attacker could exploit this vulnerability by sending crafted HTTPS requests to an affected system. A successful exploit could allow the attacker CVSSv3.1 8.6 (HIGH) · EPSS 47th percentile
A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the CPU of an affected device to spike to 100 percent, which could stop all traffic processing and result in a denial of service (DoS) condition. FTD management traffic is not affected by this vulnerability. This vulnerability is due to improper error checking when parsing fields withi CVSSv3.1 8.6 (HIGH) · EPSS 49th percentile
A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that are running Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vul CVSSv3.1 8.2 (HIGH) · EPSS 14th percentile
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation. CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile
A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain packets when they are sent to the inspection engine. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A suc CVSSv3.1 8.6 (HIGH) · EPSS 52th percentile
A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper processing of ICMPv6 messages. An attacker could exploit this vulnerability by sending crafted ICMPv6 messages to a targeted Cisco ASA or FTD system with IPv6 enabled. A successful exploit could allow the atta CVSSv3.1 8.6 (HIGH) · EPSS 48th percentile
Elastic Security Labs disclosed a sophisticated DPRK-attributed intrusion (REF7001/Lazarus Group) targeting blockchain engineers via a fake cryptocurrency arbitrage bot distributed on Discord. The attack chain comprises five stages: initial Python dropper (Watcher.py), secondary droppers (testSpeed.py, FinderTools), obfuscated loader (SUGARLOADER), Discord application hijacking persistence (HLOADER), and a full-featured macOS implant (KANDYKORN) with file exfiltration, command execution, and process manipulation capabilities. The intrusion leverages reflective binary loading, RC4-encrypted C2 communications, and novel macOS persistence techniques to evade detection.
An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components. CVSSv3.1 9.8 (CRITICAL) · EPSS 54th percentile