1118 matches found
2020 Shows the Danger of a Decapitated Cyber Regime
Trump's White House has long been AWOL on cybersecurity. That lack of oversight almost seemed to be working—until the SolarWinds hack...
Unauthorized Access Vulnerability in Phisung House Website Building System
Phaethon House is an online notebook for operators and maintainers. An unauthorized access vulnerability exists in the Phaidon House builder system, which can be exploited by an attacker to arbitrarily edit site content...
File Upload Vulnerability in Phisung House Website Building System
Phaethon House is an online notebook for operators and maintainers. A file upload vulnerability exists in the Phaidon House builder system that can be exploited by an attacker to gain control of the server...
House Rental 1.0 - 'keywords' SQL Injection
Exploit Title: House Rental 1.0 - 'keywords' SQL Injection Exploit Author: Bobby Cooke boku & Adeeb Shah @hyd3sec Date: 2020-08-07 Vendor Homepage: https://projectworlds.in Software Link: https://projectworlds.in/wp-content/uploads/2019/06/home-rental.zip Version: 1.0 Tested On: Windows 10 Pro...
New Grelos Skimmer Variants Siphon Credit Card Data
Just as seasonal online shopping kicks into high gear, new variants of the point-of-sale Grelos skimmer malware have been identified. Variants are targeting the payment-card data of online retail shoppers on dozens of compromised websites, researchers warn. The Grelos skimmer malware has been...
CVE-2020-9049
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid...
Authorization
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid...
CVE-2020-9049 victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid...
CVE-2020-9049
CVE-2020-9049 affects Johnson Controls Victor Web Client and Software House C•CURE Web Client. Affected products: victor Web Client up to v5.6 and C•CURE Web Client up to v2.90; mitigations include upgrading to victor v5.6 SP1 and C•CURE Web Client v2.70+ with updates (Web Client_c2.70_5.2_Update...
Michael Ellis as NSA General Counsel
Over at Lawfare, Susan Hennessey has an excellent primer on how Trump loyalist Michael Ellis got to be the NSA General Counsel, over the objections of NSA Director Paul Nakasone, and what Biden can and should do about it. While important details remain unclear, media accounts include numerous...
Report: CISA Chief Expects White House to Fire Him
Top U.S. cybersecurity official Christopher Krebs said he expects to be fired by the Trump administration after he delivered a secure presidential election that didn’t go in the current administration’s favor. Krebs, the first and current director of the Department of Homeland Security’s DHS’s...
ourhouseforsale.com Cross Site Scripting vulnerability OBB-1494581
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
passivehouse-international.org Improper Access Control vulnerability OBB-1463235
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
dutchhouse.com.tw Cross Site Scripting vulnerability OBB-1453727
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
passivehouse-database.org Cross Site Scripting vulnerability OBB-1449246
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
oxfordhouse.org Cross Site Scripting vulnerability OBB-1397704
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Design/Logic Flaw
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack...
CVE-2020-9048 victor Web Client - Arbitrary File Deletion Vulnerability
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack...
CVE-2020-9048
CVE-2020-9048 affects American Dynamics victor Web Client and Software House CCURE Web Client. The root cause is Improper Authorization (CWE-285) allowing a remote, unauthenticated attacker on an adjacent network to delete arbitrary files or cause a DoS, potentially rendering the system unusable....
PT-2020-20461 · American Dynamics +1 · American Dynamics Victor Web Client +1
Name of the Vulnerable Software and Affected Versions: American Dynamics victor Web Client versions up to and including v5.4.1 Software House CCURE Web Client affected versions not specified Description: A remote unauthenticated attacker on the network could delete arbitrary files on the system o...