7159 matches found
Microsoft Exchange Servers See ProxyLogon Patching Frenzy
The patching level for Microsoft Exchange Servers that are vulnerable to the ProxyLogon group of security bugs has reached 92 percent, according to Microsoft. The computing giant tweeted out the stat earlier this week – though of course patching won’t fix already-compromised machines. Still, that...
Weak password vulnerability in Huawei AR Web Management Platform (CNVD-2021-25876)
Huawei Technologies Co., Ltd, founded in 1987, is headquartered in Longgang District, Shenzhen, Guangdong Province. 1 Huawei is a leading global information and communications technology ICT solutions provider, specializing in the ICT field, adhering to sound management, continuous innovation and...
Phish Leads to Breach at Calif. State Controller
A phishing attack last week gave attackers access to email and files at the California State Controllers Office SCO, an agency responsible for handling more than $100 billion in public funds each year. The phishers had access for more than 24 hours, and sources tell KrebsOnSecurity the intruders...
PT-2021-17388
Name of the Vulnerable Software and Affected Versions Clansphere CMS version 2011.4 Description The issue allows unauthenticated reflected XSS via the module parameter. This can be exploited by an attacker to inject malicious scripts into the website, potentially leading to unauthorized access or...
PT-2021-17389
Name of the Vulnerable Software and Affected Versions Clansphere CMS version 2011.4 Description The issue allows unauthenticated reflected XSS via the language parameter. This enables an attacker to inject malicious code into a user's browser, potentially leading to unauthorized actions or data...
Why Banks Are Still A Top Target For DDoS Attacks
The financial services sector is still a prime target for cyber criminals and it has been widely reported that in 2020 financial institutions came under attack more than ever before. According to Boston Consulting Group research, financial service firms are up to 300 times more likely to experien...
SQL Injection Vulnerability in Website Building System of Nantong XED Software Co. Ltd (CNVD-2021-22607)
Nantong XED Software Co., Ltd. is a professional company engaged in website production, Internet marketing, SEO optimization. Nantong XED Software Co., Ltd. website building system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the...
PT-2021-17759
Name of the Vulnerable Software and Affected Versions: TranzWare e-Commerce Payment Gateway TWEC PG versions prior to 3.1.27.5 Description: The issue is related to a Stored cross-site scripting XSS vulnerability in the index.jsp file. This vulnerability allows for the storage of malicious scripts...
PT-2021-14093
Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.4 Description: The issue is related to improper access control in the Bulletin Board component, allowing authenticated attackers to bypass access restrictions and obtain data via unspecified vectors...
CVE-2021-20630: Undefined Security Weakness
Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone Messages via unspecified vectors...
PT-2021-14091
Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.4 Description: The issue is related to improper access control in Phone Messages, allowing authenticated attackers to bypass access restrictions and obtain data via unspecified vectors...
Mimecast: SolarWinds Attackers Stole Source Code
Hackers who compromised Mimecast networks as part of the SolarWinds espionage campaign have swiped some of the security firm’s source code repositories, according to an update by the company. The email security firm initially reported that a certificate compromise in January was part of the...
Magecart Attackers Save Stolen Credit-Card Data in .JPG File
Magecart attackers have found a new way to hide their nefarious online activity by saving data they’ve skimmed from credit cards online in a .JPG file on a website they’ve injected with malicious code. Researchers at website security firm Sucuri discovered the elusive tactic recently during an...
USN-4872-1: Axel vulnerability
It was discovered that Axel did not properly verify the certificates for hostnames. An attacker could use this vulnerability to impersonate another server and obtain sensitive information...
Chinese hackers using RedXOR backdoor against Linux systems
By Deeba Ahmed RedXOR malware can steal data, gather system information such as the MAC address, username, clock speed, distribution, and kernel version, etc. This is a post from HackRead.com Read the original post: Chinese hackers using RedXOR backdoor against Linux systems...
NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)
The remote NewStart CGSL host, running version MAIN 4.06, has firefox packages installed that are affected by multiple vulnerabilities: - When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable...
DEBIAN-CVE-2021-21185
Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome Extension...
Google Play Harbors Malware-Laced Apps Bent on Spying
A malware dropper that paves the way for attackers to remotely steal data from Android phones has been spreading via nine malicious apps on the official Google Play store, according to researchers. The malware is part of a campaign aimed at lifting victims’ financial information, but which also...
Malware Can Exploit New Flaw in Intel CPUs to Launch Side-Channel Attacks
A new research has yielded yet another means to pilfer sensitive data by exploiting what's the first "on-chip, cross-core" side-channel attack targeting the ring interconnect used in Intel Coffee Lake and Skylake processors. Published by a group of academics from the University of Illinois at...
