Security feature bypass

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

CVE-2021-34273

A security flaw in the 'owned' function of a smart contract implementation for BTC2X B2X, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

PT-2021-20419

Name of the Vulnerable Software and Affected Versions: RobotCoin RBTC affected versions not specified Description: A security flaw in the owned function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and...

Smart car chargers. Plug-n-play for hackers?

Over the last 18 months, we’ve been investigating the security of smart electric vehicle chargers. These allow the owner to remotely monitor and manage the charge state, speed and timing of their car charger, among many functions. We bought 6 different brands of chargers and also reviewed securit...

Cross-site Scripting (XSS) - Reflected in dolibarr/dolibarr

Description Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious...

bivouac-framework (0.1.0a0), cornerstonecms (>=0.1.0, <=0.1.20) +6 more potentially affected by CVE-2021-23401 via flask-user (>=0.6.1, <=1.0.2.2)

flask-user PYPI version =0.6.1, =0.1.0, =0.1.0, =0.0.39, =0.8.8, =0.1.0a3, =0.1.1a6 Source cves: CVE-2021-23401 Source advisory: SNYK:PYTHON-FLASKUSER-1293188...

GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

The Weakest Link in Your Security Posture: Misconfigured SaaS Settings

In the era of hacking and malicious actors, a company's cloud security posture is a concern that preoccupies most, if not all, organizations. Yet even more than that, it is the SaaS Security Posture Management SSPM that is critical to today's company security. Recently Malwarebytes released a...

Account Hijacking Site OGUsers Hacked, Again

For at least the third time in its existence, OGUsers -- a forum overrun with people looking to buy, sell and trade access to compromised social media accounts -- has been hacked. An offer by the apparent hackers of OGUsers, offering to remove account information from the eventual database leak i...

CVE-2020-26236

In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and i...

CVE-2020-26236

The CVE-2020-26236 vulnerability affects ScratchVerifier and describes a verification-code hijack during login. According to Red Hat/CVE listings and cross-referenced sources, before commit a603769 an attacker can hijack a user’s login flow on any site using ScratchVerifier: the attacker initiate...

PT-2020-16365

Name of the Vulnerable Software and Affected Versions ScratchVerifier versions prior to commit a603769 Description An attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. The exploitation involves the following steps: 1...

Sokrates SOWA SowaSQL Cross Site Scripting

Title: SOWA.OPAC Reflected Cross Site Scripting Vulnerability Type: Cross Site Scripting XSS Attack Type: Account Hijacking, Credential Theft, Data Leakage Author: Marek Holka Date: 2020-11-08 Vendor: SOKRATES-software Software Link: https://www.demo.sowwwa.pl/sowacgi.php Version: SOWA.OPAC all...

CVE-2020-0387

In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

Design/Logic Flaw

In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2020-0387

CVE-2020-0387 affects the SmartSpace package: in its manifest files there is a tapjacking vector caused by a missing permission check. The issue enables local elevation of privilege and possible account hijacking, with exploitation requiring user interaction. The vulnerability is categorized as a...

CVE-2020-0387

In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

PT-2020-11740

Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a possible tapjacking vector in the manifest files of the SmartSpace package due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no...

CVE-2020-0387: Missing Authorization

In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

The Joys of Owning an ‘OG’ Email Account

When you own a short email address at a popular email provider, you are bound to get gobs of spam, and more than a few alerts about random people trying to seize control over the account. If your account name is short and desirable enough, this kind of activity can make the account less reliable...