7157 matches found
SolarWinds APT Targets Tech Resellers in Latest Supply-Chain Cyberattacks
The SolarWinds attackers – an advanced persistent threat APT known as Nobelium – have started a new wave of supply-chain intrusions, this time using the technology reseller/service provider community to attack their targets. The activity has affected victims in North America and Europe thus far,...
International Operation Knocks Notorious REvil Group Offline
Plus: Data theft in Argentina, a Sinclair Broadcast Group hack, and more of the week’s top security news...
We dig into the Game Players Code
Gaming security is getting a lot of attention at the moment. Rightly so; it’s a huge target for scammers and malware authors. Malicious ads, fake games, survey scams, phishing attacks…whatever you can think of, it’s in use. Some target kids and steal their accounts, selling them on. Others go aft...
CVE-2021-34743: Cross-Site Request Forgery (CSRF)
A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...
Credential Stuffing Attack: ❗️ Definition and Protection
Introducing A new SecureAuth study discovered that 53% of shoppers reuse similar secret phrase for various accounts. When login credentials are presented to programmers, even once, they can be utilized to get to a large number of records, regardless of whether it is an email account, medical...
CVE-2021-31373
A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...
CVE-2021-31373
A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...
CVE-2021-31355
A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...
Cross site scripting
A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...
CVE-2021-31373 Junos OS: SRX Series: Persistent XSS vulnerability in J-Web
A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...
Session fixation
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to intercept the communication and steal sensitive information or hijack the session...
CVE-2021-38464 InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to intercept the communication and steal sensitive information or hijack the session...
CVE-2021-31355: Improper Neutralization of Input During Web Page Generation
A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...
PT-2021-19271
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series versions 18.2 through 18.2R3-S8 Juniper Networks Junos OS on SRX Series versions 18.3 through 18.3R3-S5 Juniper Networks Junos OS on SRX Series versions 18.4 through 18.4R3-S8 Juniper Networks Junos OS o...
PT-2021-19255
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions 12.3X48 prior to 12.3X48-D105 Juniper Networks Junos OS versions 15.1X49 prior to 15.1X49-D220 Juniper Networks Junos OS versions 18.3 prior to 18.3R3-S5 Juniper Networks Junos OS versions 18.4 prior to...
CVE-2021-31373: Improper Input Validation
A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...
ZZCMS subzs.php component SQL injection vulnerability
ZZCMS is a content management system CMS from the Zzcms team in China.ZZCMS version 2019 is vulnerable to SQL injection, which stems from the lack of effective filtering and escaping of SQL statements in the subzs.php component. An attacker could use this vulnerability to execute illegal SQL...
ZZCMS SQL Injection Vulnerability (CNVD-2021-103656)
ZZCMS is a content management system CMS from the Zzcms team in China.ZZCMS version 2019 is vulnerable to a SQL injection vulnerability that originates from a missing validation of external input SQL statements in the dlid parameter on the application's /dl/dlprint.php page. An attacker could use...
U.S. Dept Of Defense: Cross-site Scripting (XSS) - Reflected at https://██████████/
Hello Team, i just found a reflected xss bug on your web https://█████ Step To reproduce: poc url: https://████/7/0/33/1d/www.citysearch.com/search?what=x&where=place%22%3E%3Csvg+onload=confirmdocument.domain%3E Impact Impact Data can be stolen, or Javascript can be executed.This is will allow th...