Security Bulletin: IBM Content Navigator is affected by a vulnerability in Dojo Toolkit (CVE-2018-15494)

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DataGrid component. A remote attacker could exploit thi...

Abine Blur Password Manager exposed data of 2.4M users

By Waqas The password manager exposed the data due to a misconfigured S3 bucket. The Blur privacy and password management service developer Abine has issued a security notice this Monday stating that a file containing important customer data was accidentally exposed to the internet. Originally, t...

China's APT10

Wired has an excellent article on China's APT10 hacking group. Specifically, on how they hacked managed service providers in order to get to their customers' networks. I am reminded of the NSA's "I Hunt Sysadmins" presentation, published by the Intercept. EDITED TO ADD 1/5: Another article on the...

WordPress Saphali-Customer-Reviews 5.0.2 Shell Upload

Exploit Title : WordPress Saphali-Customer-Reviews Plugins 5.0.2 Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org saphali.com Software Download Link : saphali.com/wordpress-plugin-reviews...

ZeusCart 4.0 - Cross-Site Request Forgery (Deactivate Customer Accounts) Vulnerability

Exploit for php platform in category web applications Exploit Title: ZeusCart4.0 Deactivate Customer Accounts CSRF Exploit Author: mqt Vendor Homepage: http://http://www.zeuscart.com/ Version: Zeus Cart 4.0 CSRF 1. Vulnerability Description Due to the form not being validated, ZeusCart4.0 suffers...

ZeusCart 4.0 Cross Site Request Forgery

Exploit Title: ZeusCart4.0 Deactivate Customer Accounts CSRF Date: 12/20/2018 Exploit Author: mqt Vendor Homepage: http://http://www.zeuscart.com/ Version: Zeus Cart 4.0 CSRF 1. Vulnerability Description Due to the form not being validated, ZeusCart4.0 suffers from a Cross Site Request Forgery...

Caribou Coffee, Bruegger’s Bagels Bitten by Breach

Hundreds of Caribou Coffee and Bruegger’s Bagels stores have been targeted in a point-of-sale POS system data breach that attempted to steal customers’ payment cards. Hackers gained unauthorized access to the company’s POS systems, exposing some customers’ data – including name and credit-card...

Threat Roundup for Dec. 14 to Dec. 21

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 14 and Dec. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

Amazon sent 1,700 audio recordings of Alexa user to a stranger

By Waqas An Amazon customer in Germany under the European Union data protection law called GDPR General Data Protection Regulation requested the company to send all the data it stored on him but little did he know he was about to get his hands on a trove of 1,700 audio recordings of a stranger...

ZeusCart 4.0 - Cross-Site Request Forgery (Deactivate Customer Accounts)

ZeusCart 4.0 - Cross-Site Request Forgery Deactivate Customer Accounts Exploit Title: ZeusCart 4.0 Deactivate Customer Accounts CSRF Date: 12/20/2018 Exploit Author: mqt Vendor Homepage: http://http://www.zeuscart.com/ Version: Zeus Cart 4.0 CSRF 1. Vulnerability Description Due to the form not...

ZeusCart 4.0 - Cross-Site Request Forgery (Deactivate Customer Accounts)

Exploit Title: ZeusCart 4.0 Deactivate Customer Accounts CSRF Date: 12/20/2018 Exploit Author: mqt Vendor Homepage: http://http://www.zeuscart.com/ Version: Zeus Cart 4.0 CSRF 1. Vulnerability Description Due to the form not being validated, ZeusCart4.0 suffers from a Cross Site Request Forgery...

Shopify: Reflected XSS in *.myshopify.com/account/register

Shopify allows shop admin to enable customer registration. When a customer registers with a short password and HTML content as the first name and last name then customer redirects to .myshopify.com/account/register with error messages and the provided data. As there is no Cross-site Scripting...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2018-1957)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Potenti...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2018-1926)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Potenti...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2018-1904)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Potenti...

Information disclosure

A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within the customer's MarketCard balance, and also could lead to Customer Information Disclosure. The vulnerability is due to lack of proper validation of the UPC ba...

CVE-2018-12076

CVE-2018-12076 affects Avanti Markets MarketCard. The issue is a lack of proper validation of the MarketCard UPC bar code, enabling an unauthenticated, local attacker to access funds on a customer’s balance and potentially disclose customer information by generating a copy of a bar code. The conn...

CVE-2018-12076

A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within the customer's MarketCard balance, and also could lead to Customer Information Disclosure. The vulnerability is due to lack of proper validation of the UPC ba...

Compromising vital infrastructure: the power grid

Where were you when the lights went out? That line became famous after the 1977 blackout in New York City. This power outage was caused by lightning and lasted for up to two days, depending on which part of New York you lived in. While in this case the power grid failure was a freak incident due ...

PT-2018-10991 · Avanti Markets · Marketcard

Name of the Vulnerable Software and Affected Versions: Avanti Markets MarketCard affected versions not specified Description: A vulnerability exists due to the lack of proper validation of the UPC bar code on the MarketCard. This could allow an unauthenticated, local attacker to access funds with...