CVE-2021-25647

Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...

Testesdecodigogratis Testes de Codigo Cross-Site Scripting Vulnerability

Testesdecodigogratis Testes de Codigo is a mobile application from Testesdecodigogratis Portugal that provides users with driver's license learning. A cross-site scripting vulnerability exists in Testesdecodigogratis Testes de Codigo v11.3 and prior that allows storing the "Feedback" message fiel...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities see the Cisco Security Advisories page. CISA encourages user...

Microsoft Releases Security Updates for Edge

Microsoft has released a security update to address multiple vulnerabilities in Edge Chromium-based. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the latest entry for Microsoft Security Advisory...

NSA Releases Guidance on Eliminating Obsolete TLS Protocol Configurations

The National Security Agency NSA has released a Cybersecurity Information CSI sheet on eliminating obsolete Transport Layer Security TLS configurations. The information sheet identifies strategies to detect obsolete cipher suites and key exchange mechanisms, discusses recommended TLS...

A week in security (December 28 – January 3)

First off we would like to wish all our readers a happy and secure 2021! Last week on Malwarebytes Labs we presented an overview of developments in the SearchDimension hijackers, we looked at the most enticing cyberattacks of 2020, and we also looked back at the strangest cybersecurity events of...

A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

Google has patched a bug in its feedback tool incorporated across its services that could be exploited by an attacker to potentially steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9 by security researcher Sreer...

A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

Google has patched a bug in its feedback tool incorporated across its services that could be exploited by an attacker to potentially steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9 by security researcher Sreer...

CISA Updates Alert and Releases Supplemental Guidance on Emergency Directive for SolarWinds Orion Compromise

CISA has updated AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, originally released December 17. This update states that CISA has evidence of, and is currently investigating, initial access vectors in addition to...

Design/Logic Flaw

An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are therefore watched by toolstack. Specifically, keys are watched by xenopsd, and data are forwarded via RPC through message-switch to xapi. The watching logic in xenopsd sends one R...

The Importance of Feedback Loops with Akamai (Part 1)

The dictionary defines feedback as "The modification or control of a process or system by its results or effects, for example in a biochemical pathway or behavioral response." Let's explore how feedback loops work within Akamai. Feedback involves getting output and inserting it back into the inpu...

Cisco Releases Security Updates for Jabber Desktop and Mobile Client Software

Cisco has released security updates to address vulnerabilities in Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA...

Adobe Releases Security Updates for Acrobat and Reader

Adobe has released security updates to address a vulnerability in Acrobat and Reader. An attacker could exploit this vulnerability to obtain sensitive information. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Adobe Security Bulletin...

CVE-2020-29257

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the q parameter to feedback.php...

CVE-2020-29259

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php...

CVE-2020-29259

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php...

CVE-2020-29257

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the q parameter to feedback.php...

Automattic: Stored XSS in wordpress.com

Summary: Hello Team, I found the Stored XSS vulnerability in the Custom Style section, this vulnerability can result in an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, performing requests in the...

Security Update Guide: Let’s keep the conversation going

Hi Folks, We want to continue to highlight changes we’ve made to our Security Update Guide. We have received a lot of feedback, much of which has been very positive. We acknowledge there have been some stability problems and we are actively working through reports of older browsers not being able...