5787 matches found
Oracle E-Business Suite Human Resources Organization Hierarchy Viewer PosServer SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Oracle E-Business Suite Human Resources. Authentication is required to exploit this vulnerability. The specific flaw exists within the Organization Hierarchy Viewer. The issue results from the lack of...
Oracle E-Business Suite Human Resources Organization Hierarchy Viewer OrgServer SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Oracle E-Business Suite Human Resources. Authentication is required to exploit this vulnerability. The specific flaw exists within the Organization Hierarchy Viewer. The issue results from the lack of...
Description of the security update for SharePoint Server 2013: May 9, 2017
Description of the security update for SharePoint Server 2013: May 9, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...
bioinformatics.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1137688 Security Researcher Dipu1A Helped patch 1014 vulnerabilities Received 6 Coordinated Disclosure badges Received 22 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting bioinformatics.org website...
Denial Of Service (DoS)
spacewalk-backend is vulnerable to denial of service. It was found that a remote attacker could upload packages to an RHN Satellite server's NULL organization without any authorization or authentication. The NULL organization stores packages synced from RHN Hosted. Although an attacker cannot put...
Helium: Hyperlink Injection on Email Invitation
DESCRIPTION Found an hyperlink injection of the name of Organization when the attacker invites the victim to his organization with injection hyperlink. STEPS 1. Add organization with the name of https://attacker.com and switch it. 2. Go to user and invite the victim using email. 3. victim will se...
Helium: Organization Takeover via invitation API
Hello @helium, today I would like to show you how a malicious user could exploit an IDOR affecting the /invitations resource to gain Administrator privileges inside an organization of which he's part of as a reader. Steps to reproduce the bug Setup Let's assume that three accounts exist: -...
Compliance in the Cloud - Effective Strategies to Ensure Success
It's no secret that the principles, controls, and terminology associated with compliance can be a confusing alphabet soup that hinders an organization's ability to go-to-market and expand its customer base. The difficulties in meeting compliance objectives are not limited to organization size or...
Hackers Hijack Routers to Spread Malware Via Coronavirus Apps
Cybercriminals are hijacking routers and changing Domain Name System DNS settings, in order to redirect victims to attacker controlled sites promoting fake coronavirus information apps. If victims download these apps, they are infected with information-stealing Oski malware. This latest attack...
WHO Targeted in Espionage Attempt, COVID-19 Cyberattacks Spike
The World Health Organization WHO has attracted the notice of cybercriminals as the worldwide COVID-19 pandemic continues to play out, with a doubling of attacks recently, according to officials there. Problematically, evidence has also now apparently surfaced that the DarkHotel APT group has tri...
Revamped HawkEye Keylogger Swoops in on Coronavirus Fears
There’s a new variant of the HawkEye keylogging malware making the rounds, featuring expanded info-stealing capabilities. Its operators are looking to capture the zeitgeist around the novel coronavirus. It’s being distributed using spam that purports to be an “alert” from the Director-General of...
WhatsApp Is at the Center of Coronavirus Response
The World Health Organization is partnering with the messaging app to help ensure trustworthy information gets out...
Coronavirus scams, found and explained
Coronavirus has changed the face of the world, restricting countless individuals from dining at restaurants, working from cafes, and visiting their loved ones. But for cybercriminals, this global pandemic is expanding their horizons. In the past week, Malwarebytes discovered multiple email scams...
Top Three Tactics for CISOs Facing Targeted Attacks
Targeted attacks are an ongoing issue and pose a large risk to your organization. What can you do to stay protected?...
Nord Security: Account deletion requests not entirely honoured. Misinformation even after seeking clarification from customer support.
Summary: Requesting account deletion from NordVPN customer support that is supposed to have "removed your account from our database." does not truly remove account from database. Even after asking if critical information such a billing information is removed, which customer support confirms...
Helium: Cleartext Transmission of Sensitive Information Leads to administrator access
The weakness of the program is Cleartext Transmission of Sensitive Information through URL Leads to administrator access. This program is having one feature like we can add users like administrator and read-only, these are roles, into organizations. Here I get the administrator role at same...
IT Operations and Security: It’s Time to Build Something Better Together
Having been in the industry for longer than I care admit, I have seen the growth pre and post public internet. With that growth, there have been many changes with how organizations address the balance of IT Operations and Security, where tension still exists. IT Ops must keep the business running...
Helium: Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint
Summary The /api/memberships/membershipID endpoint on console.helium.com is open to anyone, including read-only users in an organization. This means that a read-only member can kick a manager, administrator, or even the owner out of an organization using this vulnerability. Steps to Reproduce: 1...
Helium: Organization Takeover
Hello @helium, The console.helium.com application doesn't correctly manage the /membership/ resources and allows a user to privilege escalate an organization of which he's part of just modifying it's role. Steps to reproduce the bug 1 Let's make two user accounts: - [email protected] A...
