884 matches found
CVE-2020-28219
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1 and EcoStruxure Geo SCADA Expert 2020 Original release and Monthly Updates to September 2020, from 83.7551....
Schneider Electric EcoStruxure Geo SCADA Expert License Issue Vulnerability
Schneider Electric EcoStruxure Geo SCADA Expert ClearSCADA is a suite of data acquisition and monitoring software SCADA from Schneider Electric, France. EcoStruxure Geo SCADA Expert 2019 has a security vulnerability that stems from insufficient credential protection, which could result in risk...
GitLab: Exposure of a valid Gitlab-Workhorse JWT leading to various bad things
Summary Using the State Uploading API we could potentially do a bad thing: - Bypass Gitlab::Workhorse.verifyapirequest! This was due to the fact that Workhorse clean the URL before passing it to Rails, this is elaborated in 923027. and State Api read request.body to append it as a file!...
geo-technika.hu Cross Site Scripting vulnerability OBB-1490869
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
US private prison, detention centers operator hit by ransomware attack
By Deeba Ahmed The victim of this ransomware attack is Geo Group that runs over 120 private prisons and illegal immigration detention centers across the globe. This is a post from HackRead.com Read the original post: US private prison, detention centers operator hit by ransomware attack...
geo-technika.hu Cross Site Scripting vulnerability OBB-1471624
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Acronis: Get ip and Geo location any user via Clickjacking with inspectlet technology
Summary Get ip and Geo location any user via Clickjacking with inspectlet technology https://geoapi.acronis.com/?q=admin/views/ajax/autocomplete/user/a Steps To Reproduce 1. go to F1015419 2. will watch your geo data ex. "city":"Abu...
LatAm Banking Trojans Collaborate in Never-Before-Seen Effort
Virus Bulletin 2020 — A loose affiliation of cybercriminals are working together to author and distribute multiple families of banking trojans in Latin America – a collaborative effort that researchers say is highly unusual. Multiple, distinct malware families have plagued Latin American banking...
geo-home.com Cross Site Scripting vulnerability OBB-1356039
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Geo-Recon - An OSINT CLI Tool Desgined To Fast Track IP Reputation And Geo-locaton Look Up For Security Analysts
An OSINT CLI tool desgined to fast track IP Reputation and Geo-locaton look up for Security Analysts. Setup This tool is compactible with: Any Linux Operating System Debian, Ubuntu, CentOS Termux Linux Setup git clone https://github.com/radioactivetobi/geo-recon.git cd geo-recon chmod +x...
CVE-2020-12058
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
Geo Magazine <= 2.0 - Unauthenticated Reflected XSS
An Unauthenticated Reflected XSS vulnerability was discovered in the Geo Magazine theme through 2.0 for WordPress. Edit WPScanTeam: July 27th, 2020 - Confirmed & Escalated to Envato July 28th, 2020 - Envato Investigating August 17th, 2020 - No updates, disclosing PoC The PoC will be displayed onc...
WordPress Geo Magazine premium theme <= 2.0 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Vlad Vector in WordPress Geo Magazine premium theme versions = 2.0. Solution 2021-01-07 - we were unable to find a patched version of this theme, item removed from Theme Forest repository...
Geo Magazine <= 2.0 - Unauthenticated Reflected XSS
An Unauthenticated Reflected XSS vulnerability was discovered in the Geo Magazine theme through 2.0 for WordPress. Edit WPScanTeam: July 27th, 2020 - Confirmed & Escalated to Envato July 28th, 2020 - Envato Investigating August 17th, 2020 - No updates, disclosing The PoC will be displayed once th...
New Privacy Features Added to the Upcoming Apple iOS 14 and macOS Big Sur
Unprecedented times call for unprecedented measures. No, we're not talking about 'coronavirus,' the current global pandemic because of which Apple—for the very first time in history—organized its Worldwide Developer Conference WWDC virtually. Here we're talking about a world in which we are all...
This Asia-Pacific Cyber Espionage Campaign Went Undetected for 5 Years
An advanced group of Chinese hackers has recently been spotted to be behind a sustained cyber espionage campaign targeting government entities in Australia, Indonesia, Philippines, Vietnam, Thailand, Myanmar, and Brunei—which went undetected for at least five years and is still an ongoing threat...
Getting Insights into the Delivery Path of Media with Breadcrumbs
Problem Definition Media streaming typically involves three main components: a player, the origin, and a CDN. Typically, the content provider owns the player and the origin stack and hence is able to diagnose and troubleshoot issues, but the CDN for the most part is a black box. The player...
Veeam Backup for Microsoft 365 Support for Microsoft Office 365 Multi-Geo Tenant
Purpose This article documents Limitations and Considerations when using Veeam Backup for Microsoft 365 to protect Microsoft 365 with the Multi-Geo feature enabled. Solution Veeam Backup for Microsoft 365 6.0 and newer The Multi-Geo feature is fully supported but has the following limitations:...
Schneider Electric EcoStruxure Geo SCADA Expert Privilege Permission and Access Control Issues Vulnerability
Schneider Electric EcoStruxure Geo SCADA Expert is a suite of data acquisition and monitoring software SCADA from Schneider Electric, France. A vulnerability exists in a folder in Schneider Electric EcoStruxure Geo SCADA Expert ClearSCADA with privilege permission and access control issues. The...
CVE-2019-6854
A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert ClearSCADA -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting or certificate files. Those users must have access to the...