Dell Customer Connect 1.3.28.0 - Local Privilege Escalation

Exploit Dell Customer Connect 1.3.28.0 Privilege Escalation Date: 25.04.2017 Software Link: http://www.dell.com/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description DCCService.exe is running on autostart as...

CVE-2017-3550

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: Admin Console. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-3550

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: Admin Console. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-3550

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: Admin Console. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-3550

CVE-2017-3550 affects Oracle E-Business Suite, specifically the Customer Interaction History component (subcomponent: Admin Console). Affected versions are 12.1.1, 12.1.2 and 12.1.3. The vulnerability is described as easily exploitable and allows an unauthenticated attacker with network access vi...

Hackers Steal Payment Card Data From Over 1,150 InterContinental Hotels

InterContinental Hotels Group IHG is notifying its customers that credit card numbers and other sensitive information may have been stolen after it found malware on payment card systems at 1,174 franchise hotels in the United States. It's the second data breach that U.K.-based IHG, which owns...

Shoney’s Hit By Apparent Credit Card Breach

It's Friday, which means it's time for another episode of "Which Restaurant Chain Got Hacked?" Multiple sources in the financial industry say they've traced a pattern of fraud on customer cards indicating that the latest victim may be Shoney's, a 70-year-old restaurant chain that operates primari...

Lenovo Customer Care Software Development Kit Local Elevation of Privilege Vulnerability

The Lenovo Customer Care Software Development Kit CCSDK is a set of pre-installed software for program maintenance use by the Chinese company Lenovo. A local elevation of privilege vulnerability exists in Lenovo Customer Care Software Development Kit. A local attacker could exploit this...

Vulnerability in userid parameter of online customer service page of China Telecom's Palm Business Hall app.

China Telecom Pocket Business Office is a cell phone terminal-based application software that provides users with recharge and payment, cost inquiries and other services. The userid parameter in the online customer service page of China Telecom's Pocket Business Office app has an overstepping...

WordPress WP Customer Reviews plugin <= 3.0.8 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerabilities

Cross-Site Request Forgery CSRF/Cross-Site Scripting XSS Vulnerabilities were found in WordPress WP Customer Reviews plugin in 3.0.8 version. In version 3.0.8, and some earlier versions on this page /wp-admin/admin.php?page=wpcr3options&tab=formsettings the nonce is not included so there's no...

WordPress WP Customer Reviews plugin <= 3.0.8 - Cross-Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF Vulnerability was found in WordPress WP Customer Reviews plugin in 3.0.8 version. There's no nonce check to prevent CSRF attack. Solution Update the plugin...

“Customer Support formula Scam” fresh out of the oven, Microsoft recommends that users timely update-vulnerability warning-the black bar safety net

On the Internet, a variety of fishing and malware advertising scams is increasing, which is a well-known type of Scam is the“Customer Support formula Scam（Tech Support Scam”, and the main way to convince the user to believe their computer problems, and requests you to jump the page to“fix”the...

HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link:...

HelpDEZK 1.1.1 CSRF / Code Execution

Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link: https://codeload.github.com/albandes/helpdezk/zip/v1.1...

HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution

Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link: https://codeload.github.com/albandes/helpdezk/zip/v1.1...

Trump Signs Repeal of ISP Privacy Rules

President Trump signed congressional legislation late Monday that repeals the Federal Communications Commission’s rules that would have prevented broadband ISPs from tracking and selling its customers’ online information. Despite opposition from civil liberties groups, democrats who voted against...

Notice of Change Announcement for NetScaler SD-WAN 400-SE (Standard Edition), 400-WO (WAN Optimization Edition) and 2000 WS (Windows Server)

Citrix Systems, Inc. announces a Notice of Status Change for the NetScaler SD-WAN 400-SE, 400- WO and 2000 WS products. The tables below explain the Citrix ADC NetScaler SD-WAN life cycle management milestones as well as important information regarding dates and options during this period. The...

Android Security Bulletin—April 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air OTA update. The Google device firmware images have also been released to the Google Developer...

Symantec API Flaws reportedly let attackers steal Private SSL Keys and Certificates

A security researcher has disclosed critical issues in the processes and third-party API used by Symantec certificate resellers to deliver and manage Symantec SSL certificates. The flaw, discovered by Chris Byrne, an information security consultant and instructor for Cloud Harmonics, could allow ...

SAP Vulnerability Puts Business Data at Risk for Thousands of Companies

SAP’s patch update for this month included a fix for a critical remote code execution vulnerability in the SAP GUI client that provides remote access to a central SAP server in a corporate network. Researchers at ERPScan, a Dutch company specializing in business application security, disclosed so...