Astaroth Spy Trojan Uses Facebook, YouTube Profiles to Cover Tracks

Facebook and YouTube profiles are at the heart of an ongoing phishing campaign spreading the Astaroth trojan, bent on the eventual exfiltration of sensitive information. The attack is sophisticated in that it uses normally trusted sources as cover for malicious activities – thus evading usually...

CVE-2019-2124

In ComposeActivityEmailExternal of ComposeActivityEmailExternal.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure...

Employers Beware: Microsoft Word 'Resume' Phish Delivers Malware

Employers who receive an email from someone purporting to be a job applicant, with an attached resume, could fall victim to a difficult-to-detect phishing campaign peddling a remote-access tool used often for espionage. Researchers with Cofense said they have recently spotted emails with maliciou...

Debian DLA-1877-1 : otrs2 security update

Several security issues have been fixed in otrs2, a well known trouble ticket system. CVE-2018-11563 An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets. CVE-2019-12746 A user logged into OTRS as a...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

Code injection

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2018-20863: Improper Input Validation

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

PT-2019-10291

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 76.0.8 Description: The issue allows remote attackers to execute arbitrary code via mailing-list attachments. Recommendations: For versions prior to 76.0.8, update to version 76.0.8 or later to resolve the issue...

CVE-2019-2761

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite subcomponent: Attachments / File Upload. Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP...

CVE-2019-2761

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite subcomponent: Attachments / File Upload. Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP...

CVE-2019-2761

CVE-2019-2761 affects Oracle E-Business Suite, specifically the Application Object Library’s Attachments/File Upload subcomponent. Affects versions 12.1.3 and 12.2.3–12.2.8. The vulnerability is an unauthenticated, network-accessible issue over HTTP that can lead to unauthorized read access to a ...

CVE-2019-11730

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and...

CVE-2019-2817: Undefined Security Weakness

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite subcomponent: Folders, Files & Attachments. Supported versions that are affected are 9.3.3, 9.3.4, 9.3.5 and 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP ...

CVE-2019-2761: Undefined Security Weakness

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite subcomponent: Attachments / File Upload. Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP...

Oracle Supply Chain Products Suite Agile PLM Component Denial of Service Vulnerability

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle USA. The product provides value chain planning, value chain execution, product lifecycle management, etc. Agile PLM Product Lifecycle Management is one of the product lifecycle management components. A security...

Design/Logic Flaw

DISPUTED Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$fileid$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as th...

PT-2019-13462 · Firefly Iii · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 4.7.17.3 Description: The issue is related to stored XSS due to the lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file id$ attachment...

CVE-2019-13647: Improper Neutralization of Input During Web Page Generation

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$fileid$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in...

CVE-2019-13645: Improper Neutralization of Input During Web Page Generation

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$fileid$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in...