#mac

WordPress Stafflist plugin version 3.1.2 suffers from a cross site scripting vulnerability.

Tiger Global Management invests $35 million in SkyHawk Security to accelerate growth.

Funding follows dramatic revenue growth as identity-based access requirements skyrocket.

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Adaptive Health Integrations (AHI) has been breached. Sensitive information was accessed, but it took months to make the incident public. The post US healthcare billing services group hacked, affecting at least half a million individuals appeared first on Malwarebytes Labs.

Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.

The US, EU member states, and other non-EU countries commit to this new internet declaration and encourage others to join. The post Over 50 countries sign the “Declaration for the Future of the Internet” appeared first on Malwarebytes Labs.

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

All versions of package `com.alibaba.oneagent:one-java-agent-plugin` are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. `../../evil.exe`). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.