CVE-2018-20627

PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box...

CVE-2018-20555

The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter accesstoken, accesstokensecret, consumerkey, and consumersecret values by reading the dcwptwitter.php source code. This leads to Twitter account takeover...

CVE-2018-20626

PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20626

PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20627

PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box...

Code injection

The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter accesstoken, accesstokensecret, consumerkey, and consumersecret values by reading the dcwptwitter.php source code. This leads to Twitter account takeover...

Directory traversal

PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20627

CVE-2018-20627 concerns PHP Scripts Mall Consumer Reviews Script 4.0.3, where an HTML injection vulnerability is reported via the search box. The available connected documents confirm the affected product and the attack surface but do not provide concrete details on exploit specifics, affected ve...

CVE-2018-20626

PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20626

CVE-2018-20626 involves the PHP Scripts Mall Consumer Reviews Script 4.0.3. The connected records confirm a directory traversal vulnerability triggered by a direct request to an uploads directory (for example, wp-content/uploads/2018/12). The root cause is a traversal flaw that permits listing/po...

Reputation management in the age of cyberattacks against businesses

Avid readers of the Malwarebytes Labs blog would know that we strive to prepare businesses of all sizes for the inevitability of cyberattacks. From effectively training employees about basic cybersecurity hygiene to guiding organizations in formulating an incident response IR program, a...

Information disclosure

IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs, including email id/names, etc. IBM X-Force ID: 155148...

CVE-2018-2009

IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs, including email id/names, etc. IBM X-Force ID: 155148...

RSA Conference 2019: NIST's Privacy Framework Starts to Take Shape

Data privacy has been thrust into the limelight with the passage of the General Data Protection Regulation in Europe last year and a string of high-profile consumer privacy snafus. The National Institute of Standards and Technology has plans to help companies address data privacy with the...

Security Bulletin: API Connect is affected by an information disclosure vulnerability in the consumer API (CVE-2018-2009)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-2009 DESCRIPTION: IBM API Connect v2018 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs,...

The Latest in Creepy Spyware

The Nest home alarm system shipped with a secret microphone, which -- according to the company -- was only an accidental secret: On Tuesday, a Google spokesperson told Business Insider the company had made an "error." "The on-device microphone was never intended to be a secret and should have bee...

Will pay-for-privacy be the new normal?

Privacy is a human right, and online privacy should be no exception. Yet, as the US considers new laws to protect individuals’ online data, at least two proposals—one statewide law that can still be amended and one federal draft bill that has yet to be introduced—include an unwelcome bargain:...

National Consumer Protection Week

National Consumer Protection Week NCPW is March 3–9. This annual event encourages individuals and businesses to learn about their consumer rights and how to keep themselves secure. The Federal Trade Commission FTC and its NCPW partners provide free resources to protect consumers from fraud, scams...

CVE-2018-11932

Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9650, MDM9655, MSM8996AU,...

CVE-2018-11938

CVE-2018-11938 affects Qualcomm/Snapdragon components (e.g., IPQ8074, MSM89xx, SDx series, etc.) via improper input validation of an HLOS argument, causing potential buffer overflows and unexpected behavior. Root cause is input validation failure in the argument path from HLOS; impact could invol...