Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets

In yet another sign of a lucrative crimeware-as-a-service CaaS ecosystem, cybersecurity researchers have discovered a new Windows-based information stealer called Meduza Stealer that's actively being developed by its author to evade detection by software solutions. "The Meduza Stealer has a...

NodCMS 3.4.1 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

GZ Forum Script 1.8 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2023-31222

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or...

Newly Uncovered ThirdEye Windows-Based Malware Steals Sensitive Data

A previously undocumented Windows-based information stealer called ThirdEye has been discovered in the wild with capabilities to harvest sensitive data from infected hosts. Fortinet FortiGuard Labs, which made the discovery, said it found the malware in an executable that masqueraded as a PDF fil...

Medtronic Paceart Optima 代码问题漏洞

Medtronic Paceart Optima is a comprehensive workflow solution from Medtronic, Inc. to efficiently compile and manage patient cardiac device data. A security vulnerability exists in Medtronic Paceart Optima version 1.11 and prior versions that originates from a data deserialization issue in...

ONEST CRM 1.0 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

PT-2023-22254 · WordPress · Tms Booking For Appointments/Events Calendar – Amelia

Name of the Vulnerable Software and Affected Versions: TMS Booking for Appointments and Events Calendar – Amelia plugin versions prior to 1.0.75 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scrip...

fief-server Server-Side Template Injection vulnerability

Server-Side Template Injection Overview of the Vulnerability Server-Side Template Injection SSTI is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to...

GHSA-HJ8M-9FHF-V7JP fief-server Server-Side Template Injection vulnerability

Server-Side Template Injection Overview of the Vulnerability Server-Side Template Injection SSTI is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to...

PT-2023-33028 · Fief · Fief

Name of the Vulnerable Software and Affected Versions: Fief affected versions not specified Description: The issue is related to Server-Side Template Injection SSTI, a vulnerability within application templating engines where user input is improperly handled and embedded into the template, possib...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

New Chromeloader Shampoo Campaign Infecting Chrome and Stealing Data

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The current ChromeLoader Shampoo campaign, where users unknowingly download and execute VBScript files from malicious websites. These files trigger a series of PowerShell scripts, leading to the...

PT-2023-24328 · Datev Eg · Datev Eg Personal-Management System Comfort/Comfort Plus

Name of the Vulnerable Software and Affected Versions: DATEV eG Personal-Management System Comfort/Comfort Plus versions 15.1.0 through 16.1.1 P4 Description: A reflected cross-site scripting issue allows attackers to steal targeted users' login data by sending a crafted link. Recommendations: Fo...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

DATEV eG Personal-Management System 跨站脚本漏洞

DATEV eG Personal-Management System is a personnel management system from DATEV, Inc. A security vulnerability exists in DATEV eG Personal-Management System Comfort/Comfort Plus versions v15.1.0 through v16.1.1. An attacker could exploit the vulnerability by sending a specially crafted link to...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

PT-2023-24619 · Unknown · Robin Wilson Bbp Style Pack Plugin

Name of the Vulnerable Software and Affected Versions: Robin Wilson bbp style pack plugin versions = 5.5.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowin...