InfoSecBulletin Cybersecurity for mankind
A critical security vulnerability has been revealed in the widely used WordPress plugin called Ultimate Member, which is installed on over 200,000 websites.
The vulnerability CVE-2024-1071 has a high CVSS score of 9.8 out of 10. It was discovered and reported by security researcher Christiaan Swiers.
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
TP-Link DHCP Vulnerability Allow Attackers Takeover Routers Remotely
WSJ reports
T-Mobile hacked in massive breach of telecom networks
Palo Alto Networks Confirms critical RCE zero-day actively exploited
WordPress security company Wordfence recently published an advisory stating that the plugin is vulnerable to SQL Injection when using the ‘sorting’ parameter in versions 2.1.3 to 2.8.2. This vulnerability is due to insufficient escaping on the user supplied parameter and lack of proper preparation on the SQL query.
Attackers without authentication can take advantage of this problem to add extra SQL queries to existing ones and access important data from the database.
The issue only affects users who have enabled the “Enable custom table for usermeta” option in the plugin settings.
A fix for the flaw was released by the plugin developers on February 19, after a responsible disclosure on January 30, 2024.
