6771 matches found
A masterclass in responding to vulnerability disclosure: The Buddi app and tracker
The Buddi tracker is used for tracking elderly and vulnerable people. It’s a GPS/GSM-based clip-on device that reports wearer position to an app via a platform. It means that the wearer can easily be found by their carer or the emergency services, should they become lost and unable to make their...
Millions of GoDaddy customer data compromised in breach
Domain name registrar giant and hosting provider GoDaddy yesterday disclosed to the Securities and Exchange Commission SEC that it had suffered a security breach. In the notice, it explained it had been compromised via an "unauthorized third-party access to our Managed WordPress hosting...
GoDaddy Data Breach Exposes Over 1 Million WordPress Customers' Data
Web hosting giant GoDaddy on Monday disclosed a data breach that resulted in the unauthorized access of data belonging to a total of 1.2 million active and inactive customers, making it the third security incident to come to light since 2018. In a filing with the U.S. Securities and Exchange...
Iranian targeting of IT sector on the rise
Iranian threat actors are increasing attacks against IT services companies as a way to access their customers’ networks. This activity is notable because targeting third parties has the potential to exploit more sensitive organizations by taking advantage of trust and access in a supply chain...
Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
Description Cross site scripting vulnerability in name field on customer edit form Proof of Concept place this payload in customer name field and save " Impact This vulnerability is capable of stolen the user session...
How Imperva Leverages AWS to Help Customers Prevent Attacks
At Imperva, we’re passionate about being a trusted security partner for our customers, so we continually invest in the availability, resiliency, and scalability of our global network. We’ve made significant investments over the past year to expand our cloud footprint, including rebuilding and...
The importance of identity and Microsoft Azure Active Directory resilience
I love hearing my colleagues explain how they came to the industry because so many of their stories are unusual. I’m surprised how often I hear that people got into computer science by some fortuitous accident. Although he loved computers from the time he was a kid, Oren Melzer never expected to...
CVE-2021-30216
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in a customer-controlled product. Notes: none...
CVE-2021-30216
CVE-2021-30216 entry is rejected/not used; it does not represent an active vulnerability.
Update to GLBA Security Requirements for Financial Institutions
Heads up financial institutions: the Federal Trade Commission FTC announced the first cybersecurity updates to the Gramm Leach-Bliley Act GLBA Safeguards Rule since 2003. The new rule strengthens the required security safeguards for customer information. This includes formal risk assessments,...
CVE-2021-3062
An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to...
Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP Edition appliance Security Update
Vulnerabilities have been discovered in Citrix ADCformerlyknown asNetScaler ADC,Citrix Gateway formerlyknown asNetScaler Gateway,and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO.These vulnerabilities,if exploited,could result in the following security issues: CVE-ID|...
CVE-2021-40260
Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester Tailor Management 1.0 via the 1 eid parameter in a partedit.php and b customeredit.php, the 2 id parameter in a editmeasurement.php and b addpayment.php, and the 3 error parameter in index.php...
Froxlor 0.10.29.1 SQL Injection
Exploit Title: Froxlor 0.10.29.1 - SQL Injection Authenticated Exploit Author: Martin Cernac Date: 2021-11-05 Vendor: Froxlor https://froxlor.org/ Software Link: https://froxlor.org/download.php Affected Version: 0.10.28, 0.10.29, 0.10.29.1 Patched Version: 0.10.30 Category: Web Application Teste...
HackerOne: HackerOne Staging uses Production data for testing
Summary: Today I received an email related to smart rewards from HackerOne. This included staging environment details, such as: sender: [email protected] Privacy / Terms links pointing to domain: https://www.enorekcah.com/... This basically tells us that HackerOne is using hacker dat...
Sourcecodester Customer Relationship Management System SQL Injection Vulnerability
Sourcecodester Customer Relationship Management System is an open source Php project. Sourcecodester Customer Relationship Management System CRM is vulnerable to SQL injection in v1.0, which can be exploited by attackers via the username field in "customer/login .php" in the username field to...
Philips Tasy EMR
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Philips Equipment: Tasy EMR Vulnerabilities: SQL Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in patient’s confidential data...
CVE-2021-43130
An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System CRM 1.0 via the username parameter in customer/login.php...