CVE-2020-14499

Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials...

Exclusive: Any Chingari App (Indian TikTok Clone) Account Can Be Hacked Easily

Following vulnerability disclosure in the Mitron app, another viral TikTok clone in India has now been found vulnerable to a critical but easy-to-exploit authentication bypass vulnerability, allowing anyone to hijack any user account and tamper with their information, content, and even upload...

Weak password vulnerability in School of Continuing Education's online learning video system

Online video learning system has weak passwords for instructor accounts url: http://61.129.84.42:86/login.aspx?errtype=1 weak password account: teacher weak password password: 123456...

How bad bots are targeting the healthcare sector

Credential cracking, or password spraying, is one of the most effective ways for cybercriminals to get access to user accounts. It refers to the brute-force automated cracking, or pairing of usernames and passwords by using sophisticated high-speed bots. According to a National Cyber Awareness...

15 Billion Credentials Currently Up for Grabs on Hacker Forums

Fifteen billion usernames and passwords for a range of internet services are currently for sale on underground forums – shedding light on the sheer scope of compromised credentials that are fueling account takeovers on the internet. A report released Wednesday — “From Exposure to Takeover” by the...

First-Ever Russian BEC Gang, Cosmic Lynx, Uncovered

Researchers say they have discovered the first-ever reported Russian business email compromise BEC cybercriminal ring, showing that sophisticated attackers beyond the usual Nigerian scammers are setting their sights on the email-based attack vector. The BEC gang is called Cosmic Lynx, and has bee...

CVE-2020-14313

An information disclosure vulnerability was found in Red Hat Quay. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace...

The vulnerability of the Cisco Smart Software Manager On-Premium license management software, related to lack of access control, allows a perpetrator to create arbitrary user accounts.

The vulnerability of the Cisco Smart Software Manager On-Prem license management software is related to lack of access control. Exploiting this vulnerability allows a malicious actor to create arbitrary user accounts by sending a specially crafted HTTP request to the vulnerable device...

Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks

By Nick Biasini, Edmund Brumaghin and Mariano Graziano. Threat summary Attackers are actively distributing the Valak malware family around the globe, with enterprises, in particular, being targeted.These campaigns make use of existing email threads from compromised accounts to greatly increase...

Hackers deface Roblox accounts with pro-Trump messages

By Sudais Asif Roblox has over 100 million registered users but only a handful of accounts were compromised. As the US presidential election is nearby, voters across the 50 state empire are betting on their candidates in light of the proposals they offer. However, some are going far enough to tak...

CVE-2020-13423

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

CVE-2020-13423

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

Cross site scripting

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

PT-2020-13530 · Magento · Form Builder +1

Name of the Vulnerable Software and Affected Versions: Form Builder version 2.1.0 for Magento Description: The issue concerns multiple XSS problems that can be exploited against Magento 2 admin accounts. This can be achieved via the Current url or email field, or the User-Agent HTTP header...

CVE-2020-15333

Zyxel CloudCNM SecuManager (versions 3.1.0 and 3.1.1) is impacted by an SQL injection vulnerability that allows an attacker to discover accounts via MySQL queries such as “select * from Administrator_users” and “select * from Users_users.” Root cause is insufficient protection of the SQL query st...

CVE-2019-19506

creationtimestamp| type| source ---|---|--- 2020-06-26 00:55:02+00:00| seen| https://t.me/cibsecurity/13072 2020-07-01 11:55:30+00:00| seen| https://t.me/cibsecurity/13162 2020-07-01 14:55:25+00:00| seen| https://t.me/cibsecurity/13173...

PT-2020-14541 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax list accounts.php file,...

PT-2020-14428 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax list...

PT-2020-14542 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information without requiring authentication. The flaw exists in the ajax list accounts.php file, specifically when parsing the...

PT-2020-14543 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the...