Cross site scripting

Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...

CVE-2020-9055

Versiant LYNX CSP 3.5.2 is vulnerable to stored cross-site scripting due to insufficient input validation, enabling a local, authenticated attacker to inject JavaScript that is stored and executed for end users (possible redirects, session cookie hijacking, information disclosure). The issue is d...

CVE-2020-9055 Versiant Lynx Customer Service Portal version 3.5.2 is vulnerable to stored cross-site scripting, which may allow an attacker to execute arbitrary JavaScript

Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...

Versiant LYNX Customer Service Portal is vulnerable to stored cross-site scripting

Overview The Versiant LYNX Customer Service Portal version 3.5.2 is vulnerable to stored cross-site scripting, which may allow a local, authenticated attacker to execute arbitrary JavaScript. Description The Versiant LYNX Customer Service Portal CSP is a "full-service customer portal that provide...

XSS Vulnerability in WisdomTooth's Manual Online Customer Service Chat Service

Beijing Wisdom Tooth Bochuang Technology Co., Ltd. is a provider of intelligent full customer service platform. A cross-site scripting vulnerability exists in WisdomTooth's manual online customer service chat. An attacker can insert malicious js code into the page to obtain user cookies and other...

This Week in Security News: Trend Micro Creates Factory Honeypot to Trap Malicious Attackers and Microsoft Leaves 250M Customer Service Records Open to the Web

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, dive into a research study that explores the risks associated with common cybersecurity vulnerabilities in a factory setting. Also, read abo...

250 Million Microsoft Customer Support Records Exposed Online

If you have ever contacted Microsoft for support in the past 14 years, your technical query, along with some personally identifiable information might have been compromised. Microsoft today admitted a security incident that exposed nearly 250 million "Customer Service and Support" CSS records on...

SIM Hijacking

SIM hijacking -- or SIM swapping -- is an attack where a fraudster contacts your cell phone provider and convinces them to switch your account to a phone that they control. Since your smartphone often serves as a security measure or backup verification system, this allows the fraudster to take ov...

Error: No Licenses Associated with License Authorization Code Found in Licensing Portal

New Citrix Licensing Portal Error Message: “No licenses associated with that License Authorization Code were found. Please check the code and try again or contact Citrix Customer Service.”...

WECON PLC Editor

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: WECON Equipment: PLC Editor Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation could allow an attacker to execute code under the privileges of the application. 3. TECHNICAL DETAILS...

The Unhappiest Subscribers on Earth? Disney+ Accounts Hacked & Hijacked

The highly anticipated Disney+ streaming service launched last week – and was promptly targeted by hackers looking to compromise users’ accounts. Around 4,000 customer account credentials have shown up for sale on hacking forums for around $3 each, according to reports. An investigation by ZDNet...

UK’s Largest Mobile Carrier Relies on AWS and Imperva FlexProtect for Web Delivery and 360-Degree Application Protection

In today’s highly-competitive telecommunications market, the website is integral to successful and fast customer service. Downtime due to intrusion, data breach, or DDoS attack is intolerable. It’s why ten of the largest global telecommunications providers have chosen Imperva, including BT mobile...

Imperva Wins CRN 5-Star Partner Program 3rd Year in a Row. Here are Some Stats Behind Why.

A lot goes into building a good IT channel program. A truly-effective program should meet the vendor’s needs while also delivering attractive benefits to our partners. A successful channel program should deliver a number of key elements, including: partner profitability partner self-service acces...

How Machine Learning can Expose and Illustrate Network Threats

Although machine learning algorithms have been around for years, additional use cases are being discovered and applied all the time, particularly when it comes to network and data security. As years have passed, the skills and sophisticated approaches being utilized by hackers have risen in...

Twitter API Flaw Exposed Users Messages to Wrong Developers For Over a Year

The security and privacy issues with APIs and third-party app developers are something that's not just Facebook is dealing with. A bug in Twitter's API inadvertently exposed some users' direct messages DMs and protected tweets to unauthorized third-party app developers who weren't supposed to get...

Is chat putting your business at risk?

Now that corporate activities are increasingly taking place outside of the office, technology that enables real-time communication and collaboration among office workers and telecommuters is absolutely essential. Elements like file sharing, video conferencing and cloud access have quickly become...

ExxonMobil Bungles Rewards Card Debut

Energy giant ExxonMobil recently sent snail mail letters to its Plenti rewards card members stating that the points program was being replaced with a new one called Exxon Mobil Rewards+. Unfortunately, the letter includes a confusing toll free number and directs customers to a parked page that...

Comcast Patches Router Bug That Leaked Some Wi-Fi Passwords

Comcast patched a bug Monday that under certain conditions leaked customer SSID names and passwords of Xfinity routers. The flaw was accessible via the Comcast website used by customers to activate and manage their Xfinity router. The bug did not affect Comcast customers that used their own priva...

Expedia Orbitz Travel, Flights, Hotel Booking Site Compromised

Chicago-based online travel booking company Orbitz, a subsidiary of Expedia.com, reveals that one of its old websites has been hacked, exposing nearly 880,000 payment card numbers of the people who made purchases online. Orbitz.com is a travel fare aggregator website and travel metasearch engine,...

Simple Banking Security Tip: Verbal Passwords

There was a time when I was content to let my bank authenticate me over the phone by asking for some personal identifiers SSN/DOB that are broadly for sale in the cybercrime underground. At some point, however, I decided this wasn't acceptable for institutions that held significant chunks of our...