CVE-2018-13312

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...

CVE-2018-13312

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...

CVE-2018-13312

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...

CVE-2018-13312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...

PT-2018-11736

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the Input your notice URL field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK...

PT-2018-11731

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the User phrases button field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK A3002...

Emotet Campaign Ramps Up with Mass Email Harvesting Module

A large-scale spam campaign has launched, spreading the Emotet banking trojan. Worryingly, the offensive has launched about a week after a fresh module for mass email-harvesting was detected for the malware. Emotet is technically a banking trojan, but it’s most often used as a dropper for a varie...

Schneider Electric Software Update (SESU) (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Schneider Electric Equipment: Software Update SESU Vulnerability: DLL hijacking 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-18-305-02 Schneider Electric Software...

USN-3795-1 libssh vulnerability

Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials...

30 Million Facebook Accounts Were Hacked: Check If You're One of Them

Late last month Facebook announced its worst-ever security breach that allowed an unknown group of hackers to steal secret access tokens for millions of accounts by taking advantage of a flaw in the 'View As' feature. At the time of the initial disclosure, Facebook estimated that the number of...

All Regular Labs extensions with editor buttons

All Regular Labs extensions with editor buttons, versions before 7 September 2018, cross site scripting XSS:- - Articles Anywhere - Conditional Content - Dummy Content - Modals - Modules Anywhere - Sliders - Snippets - Tabs - Tooltips The editor button popup urls could potentially be used...

Hacking AIS

Maritime AIS, or ‘Automatic Identification System’ is used for broadcast and reception of vessel position and information alerts. It has proved invaluable since its introduction in the 1990s and has undoubtedly helped prevent many marine accidents, collisions and related incidents. Previous...

Ransomware Attack Takes Down Bristol Airport's Flight Display Screens

Bristol Airport has blamed a ransomware attack for causing a blackout of flight information screens for two days over the weekend. The airport said that the attack started Friday morning, taking out several computers over the airport network, including its in-house display screens which provide...

Deprecated / Disabled Plugins in Scan Policy - Notice

One or more plugins that were enabled in the scan policy have been either deprecated or disabled by Tenable with a notice to inform customers of the change. See plugin output for details on which plugins enabled in the scan policy have been deprecated or disabled and any other pertinent...

Threat Outbreak Alert RuleID33414: Email Messages Distributing Malicious Software on August 13, 2018

Medium Alert ID: 58691 First Published: 2018 August 14 17:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33414 may contain the following files: Name |...

CVE-2018-14440

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. SQL injection exists via the admin/noticeManageActionqueryNotice.action noticeInfo parameter...

CVE-2018-14440

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. SQL injection exists via the admin/noticeManageActionqueryNotice.action noticeInfo parameter...

CraftedWeb Cross-Site Scripting Vulnerability

CraftedWeb is a CMS Content Management System for game servers. A cross-site scripting vulnerability exists in the aaspincludes/pages/notice.php file in versions of CraftedWeb prior to 2013-09-24. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'e'...

CVE-2018-12919

In CraftedWeb through 2013-09-24, aaspincludes/pages/notice.php allows XSS via the e parameter...

Security Bulletin: IBM Tivoli Netcool Configuration Manager (ITNCM) is affected by a XStream vulnerability

Summary IBM Tivoli Netcool Configuration Manager ITNCM has addressed the following potential XStream vulnerability. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is vulnerable to a denial of service, caused by the improper handling of attempts to create an instance of the...