624 matches found
Wordpress Advanced Database Cleaner SQL注入漏洞
Wordpress Advanced Database Cleaner is an application plugin for Wordpress. The plugin is used to clean up the database by removing isolated items such as old revisions, spam comments, optimizing the database etc. A SQL injection vulnerability exists in versions of the Advanced Database Cleaner...
Barcode Scanner app on Google Play infects 10 million users with one update
UPDATE: February 12, 2021 It has come to our attention that there is another bad actor in this story. Apparently, the original publisher, LAVABIRD LTD, is not the bad actor. It is instead an account under the name "The space team." Nevertheless, there is evidence that updates of Barcode Scanner b...
WordPress Advanced Database Cleaner plugin <= 3.0.1 - Authenticated SQL injection (SQLi) vulnerability
Authenticated SQL injection SQLi vulnerability found by Nguyen Van Khanh SunCSR in WordPress Advanced Database Cleaner plugin versions = 3.0.1. Solution Update the WordPress Advanced Database Cleaner plugin to the latest available version at least 3.0.2...
Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection
The plugin did not properly sanitise user input given, allowing high privilege users admin+ to perform SQL injection attacks. https://drive.google.com/file/d/1ljyMPfcwLXP2VS8lbAKNR9SzNfX1sm3W/view?usp=sharing...
Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection
The plugin did not properly sanitise user input given, allowing high privilege users admin+ to perform SQL injection attacks. PoC https://drive.google.com/file/d/1ljyMPfcwLXP2VS8lbAKNR9SzNfX1sm3W/view?usp=sharing...
Cleaner One Pro Speeds Up Your Mac: Part 2
In Part 1 of this blog, we introduced Trend Micro Cleaner One Pro, a one-stop shop to help you speed up your Mac, highlighting the Quick Optimizer, the Main Console, and the Cleaning Tools. In Part 2, we resume the discussion of how to make your Mac run faster with the remaining Cleaner One Pro...
PT-2020-6126 · Lxml +9 · Lxml +9
Name of the Vulnerable Software and Affected Versions: lxml versions prior to 4.6.3 Description: A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. The issue arises when the safe attrs only and forms arguments are disabled in...
Cleaner One Pro Speeds Up Your Mac: Part 1
The Mac has always been pretty easy to use, but even the most ardent Mac supporters know there comes a time when their Mac is no longer new and they notice slowdowns in its performance, particularly after intensive use. They’d like a handy one-stop tool to help them optimize memory and CPU...
Windows cleaning assistant input validation error vulnerability (CNVD-2020-51417)
Windows cleaning assistant is a Trojan and malware cleaning application for Windows systems from the Windows cleaning assistant team. The program supports Microsoft Backup Tool, File Extraction, File Shredding, Internet Explorer Cleaner and Disk Cleaner. An input validation error vulnerability...
Sanitize Cross-Site Scripting Vulnerability
Sanitize is an HTML and CSS cleaner from Ryan Grove Software Developers in the USA that supports removing HTML and CSS from strings and more. A cross-site scripting vulnerability exists in Sanitize 3.0.0 and later versions fixed in version 5.2.1. When using Sanitize's "relaxed" configuration or...
Unveiled: How xHelper Android Malware Re-Installs Even After Factory Reset
Remember xHelper? A mysterious piece of Android malware that re-installs itself on infected devices even after users delete it or factory reset their devices—making it nearly impossible to remove. xHelper reportedly infected over 45,000 devices last year, and since then, cybersecurity researchers...
Unkillable xHelper and a Trojan matryoshka
It was the middle of last year that we detected the start of mass attacks by the xHelper Trojan on Android smartphones, but even now the malware remains as active as ever. The main feature of xHelper is entrenchment — once it gets into the phone, it somehow remains there even after the user delet...
GitLab: SSRF on project import via the remote_attachment_url on a Note
Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...
CVE-2020-8508
nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled...
CVE-2020-8508
nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled...
Code injection
nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled...
CVE-2020-8508
CVE-2020-8508 affects Norman Malware Cleaner 2.08.08, via nsak64.sys. The root cause is mishandling of passing function pointers between user and kernel modes, enabling an attacker to call arbitrary kernel functions. This results in high-severity impact (partial confidentiality, integrity, and av...
CVE-2020-8508
nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled...
Clario: XSS in https://mackeeper.com
Summary: XSS in https://mackeeper.com Vulnerable URL: https://mackeeper.com/mk/memory-cleaner/%3C/%3E'+alertdocument.domain%20// Vulnerable Parameter: "URL Path" Steps To Reproduce: Steps: Navigate to the Vulnerable URL Notice the pop-up...
