HuCart Cross-Site Request Forgery Vulnerability

HuCart HuCart is an open source enterprise building system. A cross-site request forgery vulnerability exists in HuCart version 5.7.4. Remote attackers can use /adminsys/index.php?load=admins&act=editinfo&acttype=add URL to add any administrator account to exploit the vulnerability...

RHEL 7 : .NET Core on Red Hat Enterprise Linux (RHSA-2019:0040)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0040 advisory. .NET Core is a managed software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

CVE-2018-4186

CVE-2018-4186 affects Apple Safari before 11.1: an information leakage in Private Browsing during handling of downloads. The issue was addressed with additional validation and a patch shipped in Safari 11.1. Related sources describe downloads not being removed from the Private Browsing downloads ...

UBUNTU-CVE-2019-6129

pngcreateinfostruct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer...

PT-2019-4184 · Libpng Developers +2 · Libpng +2

Name of the Vulnerable Software and Affected Versions: libpng version 1.6.36 Description: The issue is related to a memory leak in the png create info struct function in libpng. This leak occurs as demonstrated by pngcp. A third party has stated that they do not think it is libpng's job to free...

CVE-2018-0282

creationtimestamp| type| source ---|---|--- 2019-01-10 02:58:15+00:00| seen| https://t.me/cibsecurity/1960...

Aussie govt emergency service hacked to send fake warning alerts

By Waqas A hacker managed to infiltrate Australian emergency warning system Early Warning Network EWN. The hacker accessed the system and sent countless messages to random citizens informing them that “you’ve been hacked.” However, the warning service’s managing director Kerry Plowright claims th...

CVE-2019-0545

CVE-2019-0545 is an information-disclosure flaw in .NET Framework/.NET Core that allows bypassing CORS. The connected RHSA entry identifies the root cause as a mishandling by NCL SocketsHttpHandler of 1xx responses, leading to exposure of restricted data. Affected products include various .NET Fr...

Malvertising Campaign Delivers Double Whammy of Ransomware and Info-Stealing

A multi-payload and ongoing malvertising campaign is distributing a newly discovered info-stealer as well as the GandCrab ransomware. The info-stealer is named Vidar, after the Norse god Víðarr, who was the son of Odin in mythology. According to researcher Fumik0, who discovered it in December,...

PT-2019-6343 · D Link · Dir-868L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L Rev.B version 2.05B02 Description: The issue arises from the lack of proper sanitization of special elements in the AudioMute and AudioEnable parameters within the /HNAP1/SetClientInfoDemo message. This allows for command...

info-maman.com XSS vulnerability

Open Bug Bounty ID: OBB-719785 Description| Value ---|--- Affected Website:| info-maman.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

MobSTSPY Info-Stealing Trojan Goes Global Via Google Play

An Android spyware dubbed MobSTSPY has managed to ride trojanized apps to a widespread, global distribution, mainly via Google Play. The malware masquerades as a legitimate application purporting to be things like flashlights, games and work productivity tools. While it’s not uncommon to come...

eisobergsma.info XSS vulnerability

Open Bug Bounty ID: OBB-718520 Description| Value ---|--- Affected Website:| eisobergsma.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Typo3 CMS Static Info Tables 6.7.3 Database Disclosure

Exploit Title : Typo3 CMS Static Info Tables Extension 6.7.3 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org - extensions.typo3.org/extension/staticinfotables/ Software Download Link :...

PT-2018-14537 · Guardzilla · Guardzilla Gz180

Name of the Vulnerable Software and Affected Versions: Guardzilla GZ180 affected versions not specified Description: The issue concerns the remote upgrade feature in Guardzilla GZ180 devices, which allows command injection via a crafted new firmware version parameter, specifically the new firmwar...

CVE-2018-20607

CVE-2018-20607 describes an information-disclosure vulnerability in imcat 4.4 , where remote attackers can obtain potentially sensitive debugging information via the URI root/tools/adbug/binfo.php . The connected documents consistently identify this URI as the disclosure point, indicating a parti...

Uber: [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name

By setting a user's name to an XSS payload, a user was able to inject JavaScript which was executed on the administrative panel for Jump bikes, allowing complete compromise of the panel, exposing user activity, personal information and billing information...

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload Date: 2018-12-24 Software Link: https://wordpress.org/plugins/baggage-freight/ Exploit Author: Kaimi Website:...

CVE-2018-20479

An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wapindex.php?type=newsinfo Sid parameter...

S-CMS SQL Injection Vulnerability (CNVD-2018-26679)

S-CMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in S-CMS version 1.0, which can be exploited by remote attackers to execute SQL commands by sending the 'Sid' parameter to the wapindex.php?type=newsinfo URL...