9102 matches found
Explained: Payment Service Directive 2 (PSD2)
Payment Service Directive 2 PSD2 is the implementation of a European guideline designed to further harmonize money transfers inside the EU. The ultimate goal of this directive is to simplify payments across borders so that it's as easy as transferring money within the same country. Since the EU w...
Best Practices Regarding Sharing of a Single User Account Across Multiple Users
Microsoft strongly recommends customers avoid the use of a 'common' or 'shared' Windows logon account. A single user account should never be shared amongst different users. This is especially true when users are logging into the same physical machine. Customers who have solutions designed this wa...
sftnow Cross-Site Request Forgery Vulnerability
sftnow is an enterprise portal system which includes news category management, release management and permission management. A cross-site request forgery vulnerability exists in sftnow 2018-12-29 and earlier versions, which can be exploited by remote attackers to add admin accounts...
Linux: Deny login for system accounts
System account are used to manage applications. They are not linked with a natural person and thus do not need an interactive shell. To prevent system accounts to run any commands, the shell field in SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a...
[SECURITY] Fedora 28 Update: systemd-238-12.git07f8cd5.fc28
systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...
NetLinx Controller Unprotected Access (Telnet)
The NetLinx Controller is accessible via an unprotected Telnet connection. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Pirate matryoshka
The use of torrent trackers to spread malware is a well-known practice; cybercriminals disguise it as popular software, computer games, media files, and other sought-after content. We detected one such campaign early this year, when The Pirate Bay TPB tracker filled up with harmful files used to...
Logic Flaw Vulnerability in Cloud Premium CMS
YUNUCMS YUNUCMS is a professional marketing enterprise building system based on PHP + MYSQL as the core development. YUNUCMS has a logic flaw vulnerability, which can be exploited by attackers to overstep their rights and add administrator accounts...
Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters
Christopher Evans of Cisco Talos conducted the research for this post. Executive Summary Cisco Talos warns users that they need to keep a close eye on unsecured Elasticsearch clusters. We have recently observed a spike in attacks from multiple threat actors targeting these clusters. These attacke...
DomainMOD 4.11.01 registrar-accounts.php Cross Site Scripting
Exploit Title : DomainMOD 4.11.01 and before - Cross-Site Scripting Author Discovered By : Mohammed Abdul Raheem Company Name : TrekShield IT Solutions Date : 11-12-2019 Vendor Homepage : https://domainmod.org/ Software Information Link : https://github.com/DomainMod/DomainMod Software Affected...
CVE-2019-9042
An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...
CVE-2019-9042
An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...
FTPShell Server 6.83 - 'Account name to ban' Denial of Service (PoC)
Exploit Title: FTPShell Server 6.83 - Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2018-02-20 Vendor Homepage: http://www.ftpshell.com/index.htm Software Link: http://www.ftpshell.com/downloadserver.htm Tested Version: 6.83 Tested on: Windows 7 x64 Service Pack 1 Steps to...
Samba LDAP AD DC Privilege Escalation (CVE-2018-1057)
A privilege escalation vulnerability has been reported in the Samba. A remote attacker could exploit this vulnerability by sending crafted LDAP requests to the vulnerable service. Successful exploitation allows authenticated attackers to change other users passwords, including administrative user...
NATO Group Catfished Soldiers to Prove a Point About Privacy
With $60 and a few fake Facebook accounts, researchers were able to identify service members in a military exercise, track their movement, and even persuade them to disobey orders...
Over 92 Million New Accounts Up for Sale from More Unreported Breaches
All these numbers…. "More than 5 billion records from 6,500 data breaches were exposed in 2018" — a report from Risk Based Security says. "More than 59,000 data breaches have been reported across the European since the GDPR came into force in 2018" — a report from DLA Piper says. …came from data...
Over 92 Million New Accounts Up for Sale from More Unreported Breaches
All these numbers…. "More than 5 billion records from 6,500 data breaches were exposed in 2018" — a report from Risk Based Security says. "More than 59,000 data breaches have been reported across the European since the GDPR came into force in 2018" — a report from DLA Piper says. …came from data...
Dark Web hacker selling 92M new accounts on Dream market
By Waqas The dark web hacker “Gnosticplayers” has quickly made a reputation for his high-profile data breaches and selling user data on the infamous Dream marketplace. A couple of days ago the hacker was selling 126 million accounts stolen from new data breaches and now, the same hacker is back...