Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

WooCommerce

Everything RedTeam Tribune has reported about WooCommerce: 2 stories, newest first. Part of our Vulnerabilities coverage.

15 Oct
Vulnerabilities

Printcart Store: Arbitrary File Upload Bug Lets Attackers Write Executables to WooCommerce Servers Without Credentials

Attackers can write executable files to WooCommerce servers without credentials in Printcart Store versions up to 2.9.1.

10 Oct
Vulnerabilities

3D Product Configurator: Unauthenticated RCE via xpv_image Affects expivi <=2.16.2

A critical flaw in the 3D Product Configurator plugin allows unauthenticated attackers to execute arbitrary code on WordPress servers via a single POST request.