Denial of Service (DoS)

Overview github.com/nats-io/nats-server/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Denial of Service DoS. Untrusted accounts are able to crash the server using configs that...

Denial of Service (DoS)

Overview github.com/nats-io/nats-server/v2/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Denial of Service DoS. Untrusted accounts are able to crash the server using configs that...

PT-2020-5727 · Nats.Io · Nats Server

Name of the Vulnerable Software and Affected Versions: github.com/nats-io/nats-server/server versions prior to a fixed version Description: The issue is related to an uncontrolled resource consumption in the NATS messaging system server. This can be exploited by a remote attacker to cause a denia...

SuiteCRM CSV Injection Vulnerability

SuiteCRM is a free open source customer relationship management application. A CSV injection vulnerability exists in SuiteCRM 7.11.13 and earlier versions. The vulnerability can be exploited to conduct CSV injection attacks via the registration field in the Accounts, Contacts, Opportunities, and...

CVE-2020-15301

SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation...

CVE-2020-15301

SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation...

CVE-2020-15301

SuiteCRM is affected by a CSV Injection vulnerability (Formula Injection) in the Accounts module. OSV records describe affected versions v7.11.18–v7.11.19 and v7.10.29–v7.10.31, where a low-privileged attacker can inject payloads into input fields; when an administrator exports data to CSV from t...

PT-2020-14342 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.14 Description: The issue allows for CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. This occurs due to mishandling of these fields during a Download Import Fi...

SuiteCRM 安全漏洞

SuiteCRM is a free open source customer relationship management application. A CSV injection vulnerability exists in SuiteCRM 7.11.13 and earlier versions. The vulnerability can be exploited to conduct CSV injection attacks via the registration field in the Accounts, Contacts, Opportunities, and...

Stored XSS Vulnerability at XXL-JOB Added User

XXL-JOB is a lightweight distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored XSS vulnerability exists at XXL-JOB new users, which can be exploited by an attacker to obtain user cookie information...

SugarCRM 6.5.18 - Persistent Cross-Site Scripting

Exploit Title: SugarCRM 6.5.18 - Persistent Cross-Site Scripting Exploit Author: Vulnerability-Lab Date: 2020-11-16 Vendor Homepage: https://www.sugarcrm.com Version: 6.5.18 Document Title: =============== SugarCRM v6.5.18 - Contacts Persistent Cross Site Web Vulnerability References Source:...

Exposed Database Reveals 100K+ Compromised Facebook Accounts

Researchers have uncovered a wide-ranging global scam targeting Facebook users, after finding an unsecured database used by fraudsters to store the usernames and passwords of at least 100,000 victims. Researchers said that the cybercriminals behind the scam were tricking Facebook victims into...

Credential-Stuffing Attack Hits The North Face

The North Face has reset its customers’ passwords after attackers launched a credential-stuffing attack against the popular outdoor outfitter’s website. In a recent data-breach notification, the company told customers that it was alerted to “unusual activity involving its website,”...

CVE-2020-28415

creationtimestamp| type| source ---|---|--- 2020-11-12 22:32:13+00:00| seen| https://t.me/cibsecurity/16266 2020-11-12 22:32:15+00:00| seen| https://t.me/cibsecurity/16268...

Animal Jam data breach – Hacker leaks database with millions of accounts

By Waqas The developer of famous online playground Animal Jam has suffered a data breach that exposed tens of millions of users' data. This is a post from HackRead.com Read the original post: Animal Jam data breach - Hacker leaks database with millions of accounts...

Ragnar Locker Ransomware Gang Takes Out Facebook Ads in Key New Tactic

The Ragnar Locker ransomware group has decided to ratchet up the pressure on its latest high-profile victim, Italian liquor conglomerate Campari, by taking out Facebook ads threatening to release the 2TB of sensitive data it stole in a Nov. 3 attack – unless a $15 million ransom is paid in Bitcoi...

CVE-2020-17021

creationtimestamp| type| source ---|---|--- 2020-11-11 12:35:06+00:00| seen| https://t.me/cibsecurity/16151 2020-11-11 12:35:14+00:00| seen| https://t.me/cibsecurity/16159...

CVE-2020-17006

creationtimestamp| type| source ---|---|--- 2020-11-11 12:35:06+00:00| seen| https://t.me/cibsecurity/16151 2020-11-11 12:35:14+00:00| seen| https://t.me/cibsecurity/16159...

CVE-2020-16126

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion...

CVE-2020-0448

In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to track an account across devices, with no additional...