4174 matches found
ZuoRAT Can Take Over Widely Used SOHO Routers
A novel multistage remote access trojan RAT that’s been active since April 2020 is exploiting known vulnerabilities to target popular SOHO routers from Cisco Systems, Netgear, Asus and others. The malware, dubbed ZuoRAT, can access the local LAN, capture packets being transmitted on the device an...
CloudGoat detection_evasion Scenario: Avoiding AWS Security Detection and Response
The post CloudGoat detectionevasion Scenario: Avoiding AWS Security Detection and Response appeared first on Rhino Security Labs...
ameralabs.com Cross Site Scripting vulnerability OBB-2676112
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Google Warns Spyware Being Deployed Against Android, iOS Users
Google is warning victims in Kazakhstan and Italy that they are being targeted by Hermit, a sophisticated and modular spyware from Italian vendor RCS Labs that not only can steal data but also record and make calls. Researchers from Google Threat Analysis Group TAG revealed details in a blog post...
GHSA-CQHR-Q835-62GM Cross-site Scripting in Jenkins Sauce OnDemand Plugin
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Exploitation of this...
PortlandLabs Concrete CMS 跨站脚本漏洞
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS, which originates in /dashboard/system/express/entities/ Forms/savecontrol lacks a data validation filter for...
CVE-2022-34197
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2022-34197
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
Cross site scripting
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
Microsoft Defender for Office 365 receives highest award in SE Labs Enterprise Email Security Services test
In today’s evolving threat landscape, email represents the primary attack vector for cybercrime, making effective email protection a key component of any security strategy.1 In Q1 2022, Microsoft participated in an evaluation of email security solutions, carried out by SE labs—a testing lab focus...
Microsoft Defender for Office 365 receives highest award in SE Labs Enterprise Email Security Services test
In today’s evolving threat landscape, email represents the primary attack vector for cybercrime, making effective email protection a key component of any security strategy.1 In Q1 2022, Microsoft participated in an evaluation of email security solutions, carried out by SE labs—a testing lab focus...
Watch out for the email that says “You have a new voicemail!”
A phishing campaign is using voicemail notification messages to go after victims Office 365 credentials. According to researchers at ZScaler, the campaign uses spoofed emails with an HTML attachment that contains encoded javascript. The email claims that you have a new voicemail and that you can...
Malicious code in wix-labs-pdf-viewer-statics (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6a97614c2821cc5232fa90a61e9b64eb14e661d733b6311306972db46f004cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-7169 Malicious code in wix-labs-pdf-viewer-statics (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6a97614c2821cc5232fa90a61e9b64eb14e661d733b6311306972db46f004cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3839 Malicious code in ing-web-labs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f07d291476a1ff4d4ca7f09c9450576fd1f3c15bc843800e61bd54d9d6a613c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Panther Labs: Twitter Account hijack through broken link in https://runpanther.io
Summary: A linkhttps://twitter.com/runpanther in https://runpanther.io was broken and anyone could create that account which leads to account impersonate Steps To Reproduce: 1.Go to https://runpanther.io 2.Scroll down to bottom there you can see that twitter icon. 3.Click on that icon, you will...
Grafana -- Stored XSS
Grafana Labs reports: An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Note: Grafana Alerting is activated by default in Grafana 9.0...
New MaliBot Android Malware Found Stealing Personal, Banking Data
By Deeba Ahmed MaliBot Android Malware is also capable of bypassing 2FA Two-factor authentication. F5 Labs researchers have discovered a new… This is a post from HackRead.com Read the original post: New MaliBot Android Malware Found Stealing Personal, Banking Data...
Panther Labs: reflected XSS on panther.com
Summary: When visiting runpanther.io I got redirected to panther.com and the application failed to sanitise user's input resulting into HTML injection and possible XSS. Steps To Reproduce: F1774502 1. Go to...
Update now! Patch against vulnerabilities in Meeting Owl Pro and Whiteboard Owl devices
After a decent amount of pressure, Owl Labs has finally released updates for vulnerabilities in Meeting Owl, and Whiteboard Owl cameras. The vulnerabilities were reported to Owl Labs in January, One of the vulnerabilities, CVE-2022-31460 has been added to the Known exploited vulnerabilities catal...