Where to find Opera’s Privacy and Security team online

Security Where to find Opera’s Privacy and Security team online Share September 27th, 2023 Hello everyone! Through this blog, we strive to offer timely updates and important information about Opera and our products. This helps us maintain an open line of communication with our users, particularly...

CVE-2023-41324 Account takeover through API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...

PT-2023-6841 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to insecure privilege management in GLPI, a free asset and IT management software package. An API user with read access to user resources can steal accounts of other users. The...

USN-6190-2 accountsservice vulnerability

USN-6190-1 fixed a vulnerability in AccountsService. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Kevin Backhouse discovered that AccountsService incorrectly handled certain D-Bus messages. A local attacker...

SeaCMS Cross-Site Request Forgery Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version v12.8, which stems from a security issue in adminmanager.php that allows an attacker to arbitraril...

Disabled accounts still work normally

Description Disabled accounts still work normally Proof of Concept The account A is logged in and active. Admin suddenly disabled that account, but account A still works normally. Video Poc https://drive.google.com/file/d/15OHZF71pJyGaU30dQaw6NglkpZEhpOPm/view?usp=sharing...

New Variant of Banking Trojan BBTok Targets Over 40 Latin American Banks

An active malware campaign targeting Latin America is dispensing a new variant of a banking trojan called BBTok, particularly users in Brazil and Mexico. "The BBTok banker has a dedicated functionality that replicates the interfaces of more than 40 Mexican and Brazilian banks, and tricks the...

CVE-2023-31808

Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted access over the WAN interface if Remote Administration is enabled...

CVE-2023-31808

Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted access over the WAN interface if Remote Administration is enabled...

PT-2023-15397 · Ekorccp +1 · Ekorccp +1

Name of the Vulnerable Software and Affected Versions: ekorCCP and ekorRCI affected versions not specified Description: The issue is an operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated...

Technicolor TG670 Trust Management Issue Vulnerability

The Technicolor TG670 is a switch from Technicolor. A security vulnerability exists in the Technicolor TG670 version 10.5.N.9, which stems from the device containing multiple accounts with hard-coded passwords. This allows an attacker to gain unrestricted access through the WAN interface...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

Cross site scripting

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

SourceCodester Vehicle Management Cross-Site Scripting Vulnerability

SourceCodester Vehicle Management is a vehicle management software from SourceCodester, Inc. A security vulnerability exists in SourceCodester Vehicle Management version 1.0 that stems from the susceptibility to cross-site scripting XSS attacks when adding accounts via invoice numbers, recipients...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Accounts workflow via Invoice No, To, and Mammul. The vulnerability is documented under CVE-2023-42253 across multiple sources, with general indication of XSS risk but without concrete exploitation details...

NodeStealer Malware Now Targets Facebook Business Accounts on Multiple Browsers

An ongoing campaign is targeting Facebook Business accounts with bogus messages to harvest victims' credentials using a variant of the Python-based NodeStealer and potentially take over their accounts for follow-on malicious activities. "The attacks are reaching victims mainly in Southern Europe...