2442 matches found
Malicious Package
react-datepicker-plus contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...
Malicious Package
Overview Version 1.1.5 of ngx-pica contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...
Malicious Package
Overview Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from yo...
Malicious Package
Overview Version 1.0.2 of radic-util contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...
Malicious Package
Overview Version 0.1.1 of grunt-radic contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...
Malicious Package
Overview Version 0.1.2 of github-jquery-widgets contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...
PcapXray v2.5 - A Network Forensics Tool To Visualize A Packet Capture Offline As A Network Diagram
PcapXray is a Network Forensics Tool To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction. PcapXray Design Specification Goal: Given a Pcap File, plot a network diagram displaying hosts in the network,...
Joy - A Package For Capturing And Analyzing Network Flow Data And Intraflow Data, For Network Research, Forensics, And Security Monitoring
Joy is a BSD-licensed libpcap-based software package for extracting data features from live network traffic or packet capture pcap files, using a flow-oriented model similar to that of IPFIX or Netflow, and then representing these data features in JSON. It also contains analysis tools that can be...
CVE-2018-18286
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the...
Qualcomm Critical Flaw Exposes Private Keys For Android Devices
Researchers have uncovered a side-channel attack that enables a bad actor to extract sensitive data from Qualcomm’s secure keystore. The critical flaw impacts most modern Android devices that use Qualcomm chips. The issue stems from an issue in Qualcomm technology, dubbed the Qualcomm Secure...
ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager 11.0 %q This module exploits sql and command injection vulnerability in the ManageEngine AM 14 and prior version...
CVE-2018-13808
A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time o...
Design/Logic Flaw
A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time o...
CVE-2018-13808
Siemens CP1604/CP1616 devices (all versions) expose a vulnerability on port 23/tcp where an attacker with network access can either extract internal communication data or cause a Denial-of-Service. The issue is described as cleartext transmission of sensitive information, enabling eavesdropping o...
CVE-2018-13808
A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time o...
WordPress Ultimate Member 2.0.38 Cross Site Request Forgery Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress Ultimate Member Plugin 2.0.38 CSRF Discovered By: Georg Knabl Vendor Website: https://ultimatemember.com/ Software Link: https://wordpress.org/plugins/ultimate-member/ Software Download URL :...
SQL Injection Vulnerability in NetSoft Zhicheng Classifieds Website System
NetSoft Zhicheng classifieds website system is a php mysql based website building system. Netsoft Zhicheng classifieds website system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information in the database...
U.S. Dept Of Defense: [█████] Get all tickets (IDOR)
In this report I want to describe an interesting vulnerability that allows you to extract tickets with personal data on the site. When user registering a new entry, the user receives a link with a ticket number and a random 4-digit code. The vulnerability is that this code can be easily bruted, s...
SQL injection vulnerability in the front-end zh***_mo***.asp file of the online bookkeeping management system of Environmental Times Enterprises (CNVD-2019-06672)
Eco Times Business Online Bookkeeping Management System is a financial online bookkeeping software. There is a SQL injection vulnerability in the zhmo.asp file in the frontend of the EcoTimes Enterprise Online Bookkeeping Management System. An attacker can exploit the vulnerability to obtain...
