CyberAlerts

Crimelords and spies for rogue states are working together, says Google

Source: TheRegister

February 12th, 2025 (5 months ago)

Description: CISOs are finding themselves more involved in AI teams, often leading the cross-functional effort and AI strategy. But there aren’t many resources to guide them on what their role should look like or what they should bring to these meetings. We’ve pulled together a framework for security leaders to help push AI teams and committees further in their AI adoption—providing them with the

Source: TheHackerNews

February 12th, 2025 (5 months ago)

WebSocket Unencrypted Traffic

Description: Web App Scanning Plugin ID 114412 with High Severity Synopsis WebSocket Unencrypted Traffic Description WebSocket is a protocol used by modern web application to allow full duplex communication between clients and servers for real-time web applications. By default, WebSocket protocol does not use any encryption when using the base ws:// URL scheme, leaving it open to man-in-the-middle attacks. Solution Ensure that WebSocket use the TLS encrypted transport protocol. Read more at https://www.tenable.com/plugins/was/114412

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

GSheetConnector for Forminator Forms for WordPress Cross-Site Scripting

Description: Web App Scanning Plugin ID 114591 with Medium Severity Synopsis GSheetConnector for Forminator Forms for WordPress Cross-Site Scripting Description The WordPress GSheetConnector for Forminator Forms Plugin installed on the remote host is affected by a Cross-Site Scripting (XSS) vulnerability.Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. Solution Remove GSheetConnector for Forminator Forms plugin Read more at https://www.tenable.com/plugins/was/114591

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Multilang Contact Form Plugin for WordPress Cross-Site Scripting

Description: Web App Scanning Plugin ID 114592 with High Severity Synopsis Multilang Contact Form Plugin for WordPress Cross-Site Scripting Description The WordPress Multilang Contact Form Plugin installed on the remote host is affected by a Cross-Site Scripting (XSS) vulnerability.Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. Solution Remove Multilang Contact Form plugin Read more at https://www.tenable.com/plugins/was/114592

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Build Private Store For Woocommerce Plugin for WordPress < 1.1 Cross-Site Request Forgery

Description: Web App Scanning Plugin ID 114593 with Medium Severity Synopsis Build Private Store For Woocommerce Plugin for WordPress < 1.1 Cross-Site Request Forgery Description The WordPress Build Private Store For Woocommerce Plugin installed on the remote host is affected by a Cross-Site Request Forgery (CSRF) vulnerability.Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. Solution Upgrade to Build Private Store For Woocommerce 1.1 or later Read more at https://www.tenable.com/plugins/was/114593

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Nginx 1.27.x < 1.27.4 SSL Session Reuse

Description: Web App Scanning Plugin ID 114594 with Medium Severity Synopsis Nginx 1.27.x < 1.27.4 SSL Session Reuse Description According to its Server response header, the installed version of nginx is from 1.11.4 to 1.26.2 or 1.27.x prior to 1.27.4. It is, therefore, affected by a SSL session reuse vulnerability due to insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. Solution Upgrade to nginx version 1.27.4 or later. Read more at https://www.tenable.com/plugins/was/114594

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Nginx 1.11.4 < 1.26.3 SSL Session Reuse

Description: Web App Scanning Plugin ID 114595 with Medium Severity Synopsis Nginx 1.11.4 < 1.26.3 SSL Session Reuse Description According to its Server response header, the installed version of nginx is from 1.11.4 to 1.26.2 or 1.27.x prior to 1.27.4. It is, therefore, affected by a SSL session reuse vulnerability due to insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. Solution Upgrade to nginx version 1.26.3 or later. Read more at https://www.tenable.com/plugins/was/114595

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Atlassian Jira UserPickerBrowser Information Disclosure

Description: Web App Scanning Plugin ID 114596 with Medium Severity Synopsis Atlassian Jira UserPickerBrowser Information Disclosure Description Atlassian Jira misconfiguration can allow a remote and unauthenticated attacker to perform user enumeration against the vulnerable target instance. Solution Restrict unauthenticated access to the '/secure/popups/UserPickerBrowser.jsp' endpoint. Read more at https://www.tenable.com/plugins/was/114596

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Atlassian Confluence Public Space Detected

Description: Web App Scanning Plugin ID 114597 with Info Severity Synopsis Atlassian Confluence Public Space Detected Description Atlassian Confluence uses spaces to organize content into meaningful categories. Every space has its own set of permissions to control access to its content. By setting a space public, an administrator can make its content available to anyone inside or outside the organization. Solution Review the public spaces available and ensure that the anonymous access is expected. Read more at https://www.tenable.com/plugins/was/114597

Source: Tenable Plugins

February 12th, 2025 (5 months ago)

Threat and Vulnerability Intelligence Database

Example Searches:

	Crimelords and spies for rogue states are working together, says Google Source: TheRegister February 12th, 2025 (5 months ago)
	How to Steer AI Adoption: A CISO Guide Description: CISOs are finding themselves more involved in AI teams, often leading the cross-functional effort and AI strategy. But there aren’t many resources to guide them on what their role should look like or what they should bring to these meetings. We’ve pulled together a framework for security leaders to help push AI teams and committees further in their AI adoption—providing them with the Source: TheHackerNews February 12th, 2025 (5 months ago)
	WebSocket Unencrypted Traffic Description: Web App Scanning Plugin ID 114412 with High Severity Synopsis WebSocket Unencrypted Traffic Description WebSocket is a protocol used by modern web application to allow full duplex communication between clients and servers for real-time web applications. By default, WebSocket protocol does not use any encryption when using the base ws:// URL scheme, leaving it open to man-in-the-middle attacks. Solution Ensure that WebSocket use the TLS encrypted transport protocol. Read more at https://www.tenable.com/plugins/was/114412 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	GSheetConnector for Forminator Forms for WordPress Cross-Site Scripting Description: Web App Scanning Plugin ID 114591 with Medium Severity Synopsis GSheetConnector for Forminator Forms for WordPress Cross-Site Scripting Description The WordPress GSheetConnector for Forminator Forms Plugin installed on the remote host is affected by a Cross-Site Scripting (XSS) vulnerability.Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. Solution Remove GSheetConnector for Forminator Forms plugin Read more at https://www.tenable.com/plugins/was/114591 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	Multilang Contact Form Plugin for WordPress Cross-Site Scripting Description: Web App Scanning Plugin ID 114592 with High Severity Synopsis Multilang Contact Form Plugin for WordPress Cross-Site Scripting Description The WordPress Multilang Contact Form Plugin installed on the remote host is affected by a Cross-Site Scripting (XSS) vulnerability.Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. Solution Remove Multilang Contact Form plugin Read more at https://www.tenable.com/plugins/was/114592 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	Build Private Store For Woocommerce Plugin for WordPress < 1.1 Cross-Site Request Forgery Description: Web App Scanning Plugin ID 114593 with Medium Severity Synopsis Build Private Store For Woocommerce Plugin for WordPress < 1.1 Cross-Site Request Forgery Description The WordPress Build Private Store For Woocommerce Plugin installed on the remote host is affected by a Cross-Site Request Forgery (CSRF) vulnerability.Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. Solution Upgrade to Build Private Store For Woocommerce 1.1 or later Read more at https://www.tenable.com/plugins/was/114593 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	Nginx 1.27.x < 1.27.4 SSL Session Reuse Description: Web App Scanning Plugin ID 114594 with Medium Severity Synopsis Nginx 1.27.x < 1.27.4 SSL Session Reuse Description According to its Server response header, the installed version of nginx is from 1.11.4 to 1.26.2 or 1.27.x prior to 1.27.4. It is, therefore, affected by a SSL session reuse vulnerability due to insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. Solution Upgrade to nginx version 1.27.4 or later. Read more at https://www.tenable.com/plugins/was/114594 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	Nginx 1.11.4 < 1.26.3 SSL Session Reuse Description: Web App Scanning Plugin ID 114595 with Medium Severity Synopsis Nginx 1.11.4 < 1.26.3 SSL Session Reuse Description According to its Server response header, the installed version of nginx is from 1.11.4 to 1.26.2 or 1.27.x prior to 1.27.4. It is, therefore, affected by a SSL session reuse vulnerability due to insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. Solution Upgrade to nginx version 1.26.3 or later. Read more at https://www.tenable.com/plugins/was/114595 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	Atlassian Jira UserPickerBrowser Information Disclosure Description: Web App Scanning Plugin ID 114596 with Medium Severity Synopsis Atlassian Jira UserPickerBrowser Information Disclosure Description Atlassian Jira misconfiguration can allow a remote and unauthenticated attacker to perform user enumeration against the vulnerable target instance. Solution Restrict unauthenticated access to the '/secure/popups/UserPickerBrowser.jsp' endpoint. Read more at https://www.tenable.com/plugins/was/114596 Source: Tenable Plugins February 12th, 2025 (5 months ago)
	Atlassian Confluence Public Space Detected Description: Web App Scanning Plugin ID 114597 with Info Severity Synopsis Atlassian Confluence Public Space Detected Description Atlassian Confluence uses spaces to organize content into meaningful categories. Every space has its own set of permissions to control access to its content. By setting a space public, an administrator can make its content available to anyone inside or outside the organization. Solution Review the public spaces available and ensure that the anonymous access is expected. Read more at https://www.tenable.com/plugins/was/114597 Source: Tenable Plugins February 12th, 2025 (5 months ago)