SAP Commerce Input Validation Error Vulnerability

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. This product supports sales management, marketing management, order management and operations management. An input validation error vulnerability exists in SAP Commerce versions 1905, 2005, 2105, 2011, and 2205, which ca...

Suspected Iranian Hackers Targeted Several Israeli Organizations for Espionage

A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations as part of an espionage-focused campaign that commenced in late 2020. Cybersecurity firm Mandiant is tracking the group under its uncategorized monike...

Cisco AppDynamics Controller Authorization Issues Vulnerability

Cisco AppDynamics Controller is Cisco's ability to monitor and analyze full-stack data through accurate tracking and analysis across a highly distributed application environment. Cisco AppDynamics Controller suffers from an authorization issue vulnerability that arises from incorrect authorizatio...

Cisco AppDynamics Controller 安全漏洞

Cisco AppDynamics Controller is Cisco's ability to monitor and analyze full-stack data through accurate tracking and analysis across a highly distributed application environment. Cisco AppDynamics Controller suffers from an authorization issue vulnerability that arises from incorrect authorizatio...

Researchers Detail How Cyber Criminals Targeting Cryptocurrency Users

Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens NFTs become more mainstream, and captu...

Sourcecodester Mobile Shop System in PHP MySQL SQL注入漏洞

Sourcecodester Mobile Shop System in PHP MySQL is an online ordering system for Gadget Works developed using PHP/MySQLi. The main goal of this online ordering system is to improve customer convenience. sourcecodester Mobile Shop System in PHP MySQL 1.0 is vulnerable due to a security flaw in the...

CVE-2022-0232 User Registration, Login & Landing Pages – LeadMagic <= 1.2.7 Admin+ Stored Cross-Site Scripting

The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loadertext parameter found in the /includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary we...

WWWGrep - OWASP Foundation Web Respository

WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was...

Acronis Cyber Protect 跨站脚本漏洞

TIETEN Acronis Cyber Protect is an application from TIETEN Acronis Cyber Protect TIETEN, China. provides the ability to unify your network protection by integrating backup, disaster recovery, AI-based malware protection, remote assistance and security into a single, reliable tool. Acronis Cyber...

Eyeballer - Convolutional Neural Network For Analyzing Pentest Screenshots

Eyeballer is meant for large-scope network penetration tests where you need to find "interesting" targets from a huge set of web-based hosts. Go ahead and use your favorite screenshotting tool like normal EyeWitness or GoWitness and then run them through Eyeballer to tell you what's likely to...

Fintech Startup Offers $500 for Payroll Passwords

How much is your payroll data worth? Probably a lot more than you think. One financial startup thats targeting the gig worker market is offering up to $500 to anyone willing to hand over the payroll account username and password given to them by their employer, plus a regular payment for each mon...

CVE-2021-26123

LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm...

CVE-2021-26123

LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm...

Design/Logic Flaw

LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm...

CVE-2021-26123

The CVE-2021-26123 entry concerns LivingLogic XIST4C prior to version 0.107.8, which is vulnerable to cross-site scripting (XSS). Multiple connected sources (CNVD, NVD, Red Hat, CVE list, CNVD) confirm that XIST4C versions before 0.107.8 allow XSS via login.htm, login.wihtm, or login-form.htm. Th...

Default credentials

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default...

CVE-2020-35565

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default...

CVE-2020-35565

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 (versions up to 2.6.2) have a login brute-force protection setting that is disabled by default, creating potential unauthorized access risk. Red Hat and CISA advisories summarize this as CVE-2020-35565 with a CVSS v3 base score of 5.9 (C:H/I:N/A:N) an...

LogoKit Simplifies Office 365, SharePoint 'Login' Phishing Pages

A newly-uncovered phishing kit, dubbed LogoKit, eliminates headaches for cybercriminals by automatically pulling victims’ company logos onto the phishing login page. This gives attackers the tools needed to easily mimic company login pages, a task that can sometimes be complex. Cybercriminals hav...

BigBountyRecon - This Tool Utilises 58 Different Techniques To Expediate The Process Of Intial Reconnaissance On The Target Organisation

BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. Reconnaissance is the most important step in any penetration testing or a bug hunting process. It provides an attacke...