Fraudsters Claim To Hack Two Canadian Banks

UPDATE Two Canadian banks have reported that they may be targets of a hack, after bad actors claimed that they electronically accessed personal and account information of a combined 90,000 customers. The attackers have asked for a ransom of 1 Ripple XMR from each, which translates to around $1...

Passit: Old sessions does not expire On changing password via https://app.passit.io/account/change-password

Description : On changing password only current session using which user changes password only that expires however old sessions in any other browser or device does not expire and remains active. Reproduction Steps : To verify the issue : 1. Log in to Browser A and make sure to check 'stay logged...

Authorization

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creation of folders within another account via a modified device value...

CyberArk Password Vault Detection (HTTP)

HTTP based detection of CyberArk Password Vault. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Passit: Authentication Required When password change

Description of the issue :- I have found that when changing password in passit account there is no Authentication process by asking current password or any other confirmation If a user leaves their computer or account is still active in insecure place,or if account is hijacked or if CSRF is...

Burrowing ideas | account to attack of a several common techniques-vulnerability warning-the black bar safety net

web security incidents, the account, is usually presented to the attacker's first point of contact with account-related functions if there is a defect, an attacker can obtain the key information and important features, such as, the login fails, the error message can determine whether the because...

Upserve : Ability to reset password for account

The attacker was able to send a password reset link to an arbitrary email by sending an array of email addresses instead of a single email address. POST https://hq.breadcrumb.com/api/v1/passwordreset HTTP/1.1 with body like "emailaddress":"[email protected]","[email protected]"...

How to Fight Mobile Number Port-out Scams

T-Mobile, AT&T and other mobile carriers are reminding customers to take advantage of free services that can block identity thieves from easily "porting" your mobile number out to another provider, which allows crooks to intercept your calls and messages while your phone goes dark. Tips for...

CVE-2016-6813

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another non-"root" CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn...

Has Your O365 Account Been Hacked?

In the past six months, Coalfire has seen an increase in businesses receiving fraudulent emails from legitimate client accounts with fraudulent invoice attachments. In several cases, the recipient paid the invoices not realizing they were fraudulent. The losses have ranged between thousands and...

Enable Google's New "Advanced Protection" If You Don't Want to Get Hacked

It is good to be paranoid when it comes to cybersecurity. Google already provides various advanced features such as login alerts and two-factor authentication to keep your Google account secure. However, if you are extra paranoid, Google has just introduced its strongest ever security feature,...

Facebook will use facial recognition to unlock your account

By Carolina Facebook is known for tracking users even when they log This is a post from HackRead.com Read the original post: Facebook will use facial recognition to unlock your account...

Automattic: Invalidate session after password reset on https://polldaddy.com

Hi there, I found broken session bug on your website.Your website is unable to validate the session.That may lead takeover victims account. Reproduce: 1.Go to https://polldaddy.com and log into your account from two different browsers. 2.Now change password from any browser you already logged in...

WordPress Gym Management System Code Execution / Remote Cross Site Scripting Vulnerabilities

WordPress Gym Management System versions 07-05-2017 and below suffer from code execution and cross site scripting vulnerabilities. Exploit Title: WPGYM - Wordpress Gym Management System Member View Add weight Upload image shell.png.php Save Measurement An alert will warn you about incorrect file...

Facebook worries: I didn’t post that

It is my assumption that most Facebook users don’t look at their own profile often. With your own profile, I mean the timeline that shows up when you click your own name or avatar in the Facebook menu. That’s because we think we know exactly what is posted there, so why bother to look at it? Afte...

Charging Pile Android App has Arbitrary Account Password Reset Vulnerability

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. Charging Pile Android APP has an arbitrary account password reset vulnerability. Allowing an attacker to reset a user's password by captcha...

Nextcloud: Disabled user can reset their password

Steps: 1 Create user and disable the account 2 Goto reset password and enter disabled user's email address. Password reset link sent and he can reset the password using that link. The point is : Disabled user can still access their account via reset password page. This is a very minor issue...

account.mncdigital.id XSS vulnerability

Vulnerable URL: https://account.mncdigital.id/redirection?r=javascript:window.prompt%27OPENBUGBOUNTY%27; Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 13.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknow...

WakaTime: Failure to check password history

I discovered that old passwords could be reused and believe that wakatime.com could benefit if there was a check for old passwords in your database. Because password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period ...

WordPress: Stored xss via template injection

Hello Sir , I found Stored XSS in https://mercantile.wordpress.org/ POC is attached . Steps to reproduce: 1.Login to your account. 2. Go to https://mercantile.wordpress.org/my-account/edit-address/ & fill details , press save & intercept this request in burp suit. 3.change name to...