OpenZ ERP 3.6.60 Cross Site Scripting

Document Title: =============== OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2234 Release Date: ============= 2020-05-06 Vulnerability Laboratory ID VL-ID: ====================================...

Anti-Phishing process with advanced phishing attacks simulation

This time I want to write about the service of my friends from Antiphish. They call it “security awareness and employee behaviour management platform”. Simply put, they teach company employees how to detect and avoid phishing attacks. By the way, they are great guys, made a demo for me, prepared...

Why SaaS opens the door to so many cyber threats (and how to make it safer)

Cloud services have become increasingly important to many companies' daily operations, and the rapid adoption of web apps has allowed businesses to continue operating with limited productivity hiccups, even as global coronavirus restrictions have forced much of the world to work from home. But at...

SQL Injection Vulnerability in Road Transportation Workers Management Information System

Shenzhen Become Information Technology Co., Ltd. is a supplier of data collection equipment and solutions. There is a SQL injection vulnerability in the Road Transportation Employee Management Information System, which can be exploited by attackers to obtain sensitive information in the database...

Letter from the CEO: A time of kindness and compassion

Dear Customers, Together, we are facing a truly unprecedented situation and we have all had to adapt to the new reality. The global coronavirus pandemic is affecting our families, our communities, our organizations – indeed, it affects our perspective and way of life. As you certainly have too, a...

Hacker defaces Escrow.com by hacking GoDaddy employee’s account

By Sudais Asif If you are aware of what Escrow.com is, you may also know how huge this cyber attack is. This is a post from HackRead.com Read the original post: Hacker defaces Escrow.com by hacking GoDaddy employee's account...

Managing Team Burn Out

According to the World Health Organization: “Burn-out is a syndrome conceptualized as resulting from chronic workplace stress that has not been successfully managed. It is characterized by three dimensions: feelings of energy depletion or exhaustion increased mental distance from one’s job, or...

CVE-2019-18626

Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social...

Code injection

Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social...

Tips for Securing Remote Workers

As more and more employees are mandated to work from home, security and non-security professionals alike are left wondering what they can do to keep their data and systems safe. To help with this, we’ve compiled a list of some of the key things you can do to ensure your defenses are up—on or off...

A message from our COO regarding Trend Micro’s Customer commitment during the global Coronavirus Pandemic (COVID-19)

The recent outbreak of COVID-19 has affected peoples’ lives across the globe and has quickly swept through and impacted individuals, families, communities, and businesses around the world. At Trend Micro, our number one priority is to ensure that our employees and their families are as safe as...

CVE-2020-9758

An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...

Hackers Compromise T-Mobile Employee' Email Accounts and Steal User' Data

If you are a T-Mobile customer, this news may concern you. US-based telecom giant T-Mobile has suffered yet another data breach incident that recently exposed personal and accounts information of both its employees and customers to unknown hackers. What happened? In a breach notification posted o...

Hackers Compromise T-Mobile Employee' Email Accounts and Steal User' Data

If you are a T-Mobile customer, this news may concern you. US-based telecom giant T-Mobile has suffered yet another data breach incident that recently exposed personal and accounts information of both its employees and customers to unknown hackers. What happened? In a breach notification posted o...

U.S. Dept Of Defense: Sensitive Information Leaking Through DoD Owned Website. [██████████]

Summary While performing recon work on websites owned by DoD i came up with ██████████ website which is leaking sensitive information. Description The above website is leaking information such as- first name and last name, email address, phone number, house address and organization name of...

Unifying security policy across all mobile form-factors with Wandera and Microsoft

The way we work is evolving—technology enables more effective employees by helping them to be productive where and when they choose. Businesses have also been enjoying the productivity benefits of an always-on and always-connected workforce. While new business applications and device form-factors...

capitaemployeesolutions.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1086342 Security Researcher securaji Helped patch 77 vulnerabilities Received 3 Coordinated Disclosure badges Received 4 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting capitaemployeesolutions.co.u...

Employee Leaves Management System 2.0 Cross Site Request Forgery

Exploit Title: Employee Leaves Management System 2.0 Cross-Site Request Forgery Date: 22-01-2020 Author: Priyanka Samak Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/employee-leaves-management-system-elms/ Software: Employee Leaves Management System Version : 2.0...

How to implement Multi-Factor Authentication (MFA)

Another day, another data breach. If the regular drumbeat of leaked and phished accounts hasn't persuaded you to switch to Multi-Factor Authentication MFA already, maybe the usual January rush of 'back to work' password reset requests is making you reconsider. When such an effective option for...

CVE-2019-20183

uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension...