#xss
-
WordPress Comment2Shell: How a Comment Could Become a Server Takeover
A WordPress core flaw let an anonymous visitor plant a hidden script in a comment that fired when an administrator opened the page. The fix landed on September 17 in version 7.1.1.
-
BdThemes Supply-Chain Attack Creates Hidden WordPress Admins
An attacker compromised the infrastructure of premium plugin developer BdThemes and, through a poisoned JSON feed, created hidden administrator accounts on victims' sites.
-
Russian Group Spent Six Months Reading Western Email via a 0-day in Zimbra
Opening the message was enough: the attack stole 90 days of correspondence, the password from the browser and two-factor authentication codes. The NSA, CISA and partners issued a joint advisory.
-
Critical Zimbra Vulnerability Allows Code Execution Through Emails
Zimbra is urging customers to install updates that fix a critical vulnerability in the Classic Web Client, which allows arbitrary code execution through specially crafted emails.