TrickBot Attack Exploits COVID-19 Fears with DocuSign-Themed Ploy

Threat actors are using people’s interest in the Department of Labor’s Family and Medical Leave Act FMLA to spread what appears to be the TrickBot trojan in a new spam campaign that security researchers discovered recently. Recent analysis from spam honeypots set by IBM X-Force discovered actors...

KLA11788 Multiple vulnerabilities in Mpmtp installer

Absolutely unique vulnerability was found in mpmtp system installer. Vulnerability can be exploited different ways, but the easiest way is running installer with /dos switch which leading to a blue screen of death and the need to reinstall Windows due to a failure of the system kernel driver. Thi...

U.S. Dept Of Defense: Reflected XSS and HTML Injectionon a DoD website

Summary: I found Xss and Html injection vulnerabilities on one of the DoD websites Description: When doing the Xss tests I used this payload: alert "XSS" and when running I noticed that the server returned a 403 Forbidden error, but it was easy to do a bypass I just modified the javascript tags i...

When in Doubt: Hang Up, Look Up, & Call Back

Many security-conscious people probably think they'd never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here's how one security and...

U.S. Dept Of Defense: Previously Compromised PulseSSL VPN Hosts

Hi again!! Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is 681249. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised db...

The Pentagon Hasn't Fixed Basic Cybersecurity Blind Spots

Five years ago, the Department of Defense set dozens of security hygiene goals. A new report finds that it has abandoned or lost track of most of them...

U.S. Dept Of Defense: Members Personal Information Leak Due to IDOR

Summary https://██████ allows anyone to sign up and view other members profile. According to wikipedia, ███████ is part of US DoD "████████": ██████ I signed up with a regular account and noticed that by referencing users ████, I can send thousands of "█████████" and also, using another end-point...

Update changes the game rating systems in Windows 7

Update changes the game rating systems in Windows 7 INTRODUCTION This article describes an update that enables the game rating systems in Windows 7 to reflect the changes to the game rating systems in Windows 8. After you install this update, the game rating systems in Windows 7 will be compliant...

CVE-2020-10501

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request...

CVE-2020-10501

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request...

CVE-2020-10490

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request...

CVE-2020-10491

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request...

Cross site request forgery (csrf)

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request...

Cross site request forgery (csrf)

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request...

Cross site request forgery (csrf)

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request...

CVE-2020-10501

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request...

CVE-2020-10501

CVE-2020-10501 concerns Chadha PHPKB Standard Multi-Language 9 where a CSRF weakness in the admin/manage-departments.php endpoint allows an attacker to edit a department when a crafted request is issued. The root cause is inadequate CSRF protections on the request that performs department edits (...

CVE-2020-10491

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request...

CVE-2020-10490

CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request...

PT-2020-12160 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to delete a department via a crafted request to the admin/manage-departments.php endpoint. This is made possible by a CSRF weakness. Recommendations: For...