D-Link DAR-7000 SQL注入漏洞

DAR-7000 is an Internet Behavior Audit Gateway from AUO Electronic Devices Shanghai Co. AUO DAR-7000 suffers from a SQL injection vulnerability, which originates from the lack of validation of the parameter id of the file /user/inc/workidajax.php for externally entered SQL statements. The...

23andMe says, er, actually some genetic and health data might have been accessed in recent breach

In October we reported that the data of as many as seven million 23andMe customers were for sale on criminal forums following a password attack against the genomics company. Now, a filing with the US Securities and Exchange Commission SEC has provided some more insight into the data theft. The...

Apache Cocoon SQL Injection Vulnerability

Apache Cocoon is the United States Apache Apache Foundation of a component-based Web development concepts built Web application framework. Apache Cocoon suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacke...

Cross site scripting

dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary...

CVE-2023-49277 Reflected Cross-site Scripting Vulnerability in dpaste

dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary...

CVE-2023-49277

CVE-2023-49277 affects dpaste, a Django-based Python pastebin. The vulnerability is a reflected XSS in the expires parameter of the dpaste API, allowing an attacker to execute arbitrary JavaScript in a user’s browser. Public descriptions consistently state that versions older than dpaste v3.8 are...

Reflected XSS Vulnerability in dpaste

Impact A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized...

PT-2023-31149 · Unknown · Calendarinho

Name of the Vulnerable Software and Affected Versions: Calendarinho versions prior to commit 15b2393 Description: An Open Redirect issue occurs when the application redirects users to external URLs without proper validation, potentially leading to phishing attacks and information theft. This can...

Zoom Vulnerability Allowed Hackers to Take Over Meetings, Steal Data

By Waqas A critical Zoom Room vulnerability allowed exploiting service accounts for unauthorized tenant access. This is a post from HackRead.com Read the original post: Zoom Vulnerability Allowed Hackers to Take Over Meetings, Steal Data...

Okta: Breach Affected All Customer Support Users

When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised...

Stop Identity Attacks: Discover the Key to Early Threat Detection

Identity and Access Management IAM systems are a staple to ensure only authorized individuals or entities have access to specific resources in order to protect sensitive information and secure business assets. But did you know that today over 80% of attacks now involve identity, compromised...

Diamond Sleet supply chain compromise distributes a modified CyberLink installer

Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet ZINC involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. This malicious file is a legitima...

PT-2023-30437 · Admidio · Admidio

Name of the Vulnerable Software and Affected Versions: Admidio versions 4.2.12 and below Description: The issue is related to Cross Site Scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations: For Admidio versions 4.2.12 and...

Email Security Flaw Found in the Wild

Googles Threat Analysis Group announced a zero-day against the Zimbra Collaboration email server that has been used against governments around the world. TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. Most of this...

Malicious Apps Disguised as Banks and Government Agencies Targeting Indian Android Users

Android smartphone users in India are the target of a new malware campaign that employs social engineering lures to install fraudulent apps that are capable of harvesting sensitive data. "Using social media platforms like WhatsApp and Telegram, attackers are sending messages designed to lure user...

CVE-2023-46935

eyoucms v1.6.4 is vulnerable Cross Site Scripting XSS, which can lead to stealing sensitive information of logged-in users...

U.S. Cybersecurity Agencies Warn of Scattered Spider's Gen Z Cybercrime Ecosystem

U.S. cybersecurity and intelligence agencies have released a joint advisory about a cybercriminal group known as Scattered Spider that's known to employ sophisticated phishing tactics to infiltrate targets. "Scattered Spider threat actors typically engage in data theft for extortion using multipl...

Adobe RoboHelp 安全漏洞

Adobe RoboHelp is a help authoring tool developed and released for Windows by the American company Audobee Adobe. Adobe RoboHelp Server suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit the...

Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups

A zero-day flaw in the Zimbra Collaboration email software was exploited by four different groups in real-world attacks to pilfer email data, user credentials, and authentication tokens. "Most of this activity occurred after the initial fix became public on GitHub," Google Threat Analysis Group T...

Samsung Data Breach: Hackers Steal Data of UK Customers

By Waqas The data breach does not include passwords or financial data. This is a post from HackRead.com Read the original post: Samsung Data Breach: Hackers Steal Data of UK Customers...