U.S. Dept Of Defense: CSRF leads to Account takeover

The CSRF vulnerability was found on the endpoint https://██████████/account/profile/edit, which allowed an attacker to modify the victim's account information, including their username, password, and email address, resulting in account takeover...

U.S. Dept Of Defense: CSRF Attack leads to delete album at ████████

The report describes a CSRF vulnerability in the DoD asset ███████, specifically in the feature to create albums for a media collection. The vulnerability allows an attacker to delete a victim's album without the victim's consent, as the delete request is based on GET and lacks CSRF verification...

U.S. Dept Of Defense: XSS found for https://█████████

The XSS vulnerability was found in the /web/guest/search endpoint, where the query parameter was not properly sanitized before being reflected in the server's response. An attacker could craft a malicious payload and trick a user into sending a POST request, allowing the execution of arbitrary...

U.S. Dept Of Defense: CSRF Attack on changing security questions leads to full Account TakeOver

The CSRF vulnerability in the security questions and password reset functionality of the website allowed an attacker to change a victim's security questions and answers, and then leverage this to reset the victim's password and gain full control of the account...

U.S. Dept Of Defense: CSRF Attack leads to delete album at

The CSRF vulnerability was discovered in the media gallery feature of the DoD asset www.████████. The vulnerability allowed an attacker to delete albums without CSRF verification, as the delete request was based on a GET request. This could have led to the deletion of users' albums...

CVE-2024-33986 Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting XSS vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in...

CVE-2024-33986

The CVE-2024-33986 issue is a Cross-Site Scripting (XSS) vulnerability in Janobe-based School Attendance Monitoring System and School Event Management System (version 1.0). The root cause is untrusted input in the web interface that can be injected via the View parameter in /department/index.php,...

PayPal,Credit Card and Debit Card Payment SQL注入漏洞

PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe individual developer. A SQL injection vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can use this vulnerability to send a specially crafted quer...

U.S. DoJ Indicts North Korean Hacker for Ransomware Attacks on Hospitals

The U.S. Department of Justice DoJ on Thursday unsealed an indictment against a North Korean military intelligence operative for allegedly carrying out ransomware attacks against healthcare facilities in the country and funneling the payments to orchestrate additional intrusions into defense,...

CVE-2024-7118

A vulnerability classified as critical was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this vulnerability is an unknown functionality of the file /departmentviewmore.php. The manipulation of the argument id leads to sql injection. The attack can be...

PT-2024-38088 · Unknown · Md-Mafujul-Hasan Online-Payroll-Management-System

Name of the Vulnerable Software and Affected Versions: MD-MAFUJUL-HASAN Online-Payroll-Management-System versions up to 20230911 Description: A critical issue was found in the system, affecting an unknown functionality of the file /department viewmore.php. The manipulation of the id argument lead...

CVE-2024-7069

A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects some unknown processing of the file /employeegatepass/classes/Master.php?f=deletedepartment. The manipulation of the argument id leads to sql...

PT-2024-38059 · Sourcecodester · Sourcecodester Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: A critical issue has been found in the processing of the file /employee gatepass/classes/Master.php?f=delete department, where the manipulation of the id...

Kaspersky Exits U.S. Market Following Commerce Department Ban

Russian security vendor Kaspersky has said it's exiting the U.S. market nearly a month after the Commerce Department announced a ban on the sale of its software in the country citing a national security risk. News of the closure was first reported by journalist Kim Zetter. The company is expected...

CVE-2024-6681

A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue is some unknown functionality of the file /api/dept. The manipulation of the argument params.dataScope leads to sql injection. The attack may be launched...

PT-2024-37797 · Unknown · Witmy My-Springsecurity-Plus

Name of the Vulnerable Software and Affected Versions: witmy my-springsecurity-plus up to 2024-07-04 Description: A critical issue has been found, affecting some unknown functionality of the file /api/dept. The manipulation of the argument params.dataScope leads to SQL injection. The attack may b...

U.S. Dept Of Defense: Restrict any user from Login to their account

A security vulnerability was discovered where an attacker could change their email address to the victim's email, effectively restricting the victim from accessing their account. The vulnerability stemmed from improper authentication on the "Update Profile" functionality of the website...

The Tech Crash Course That Trains US Diplomats to Spot Threats

The US State Department is training diplomats in cybersecurity, privacy, telecommunications, and other technology issues, allowing them to advance US policy abroad...

U.S. Treasury Sanctions 12 Kaspersky Executives Amid Software Ban

The U.S. Department of the Treasury's Office of Foreign Assets Control OFAC imposed sanctions against a dozen individuals serving executive and senior leadership roles at Kaspersky Lab, a day after the Russian company was banned by the Commerce Department. The move "underscores our commitment to...

U.S. Bans Kaspersky Software, Citing National Security Risks

The U.S. Department of Commerce's Bureau of Industry and Security BIS on Thursday announced a "first of its kind" ban that prohibits Kaspersky Lab's U.S. subsidiary from directly or indirectly offering its security software in the country. The blockade also extends to the cybersecurity company's...