1365 matches found
CVE-2022-38164
A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofing as the browser only display certain part of the entire URL...
CVE-2022-43565
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation JSON lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the...
CVE-2022-43566
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards in the Analytics...
CVE-2022-43565 Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation JSON lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the...
PT-2022-26969 · Splunk · Splunk Enterprise
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.2.9 Splunk Enterprise versions prior to 8.1.12 Splunk Enterprise versions prior to 9.0.2 Description: The issue allows an authenticated user to run risky commands using a more privileged user’s permission...
CVE-2022-38197 BUG-000148347 Unvalidated redirect issues in ArcGIS Server.
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter...
JVN#86350682: Multiple vulnerabilities in SHIRASAGI
SHIRASAGI provided by SHIRASAGI Project contains multiple vulnerabilities listed below. Open Redirect CWE-601 - CVE-2022-43479 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N| Base Score: 4.7 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 Stored...
CVE-2022-41797
The CVE-2022-41797 entry describes an improper authorization flaw in Lemon8 App’s handler for a custom URL scheme.Affected software: Lemon8 App for Android and iOS (prior to version 3.3.5).Cause: the app fails to restrict URL scheme access, enabling a remote attacker to direct a user to an arbitr...
CVE-2022-41797
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a...
PT-2022-26076 · Unknown · Lemon8 App For Android +1
Name of the Vulnerable Software and Affected Versions: Lemon8 App for Android versions prior to 3.3.5 Lemon8 App for iOS versions prior to 3.3.5 Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access ...
CVE-2022-41797
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a...
CVE-2022-26954
Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the 1 ChangePassword function, 2 SignInCustomerAsync function, 3...
Security Bulletin: WebSphere eXtreme Scale Monitoring Console Web Vulnerabilities (CVE-2013-5390, CVE-2013-5393, CVE-2013-5394)
Abstract Three web security vulnerabilities were identified in the WebSphere eXtreme Scale monitoring console, those being a cross site scripting vulnerability, a log-off processing weakness, and vulnerability to a phishing attack. Content VULNERABILITY DETAILS: CVEID:CVE-2013-5390 DESCRIPTION: A...
Input validation
User input included in error response, which could be used in a phishing attack...
CVE-2021-27774 An injection vulnerability affects HCL Digital Experience
User input included in error response, which could be used in a phishing attack...
CVE-2021-27774
CVE-2021-27774 involves HCL Digital Experience and an injection-type vulnerability where user input is echoed in an error response. This behavior could enable phishing attacks by exposing or misusing input data via error messages. The connected documents corroborate that the issue centers on inpu...
CVE-2021-27774 An injection vulnerability affects HCL Digital Experience
User input included in error response, which could be used in a phishing attack...
The vulnerability of the implementation of the DefaultActionMapper mechanism in the Apache Struts software platform allows attackers to carry out phishing attacks.
The vulnerability of the DefaultActionMapper mechanism implemented by the Apache Struts software platform is related to insufficient validation of input data during the processing of parameters like redirect and redirectAction:prefix. Exploiting this vulnerability allows a malicious actor to carr...
[update] American Airlines suffers data breach after phishing incident
Major airline American Airlines has fallen victim to a data breach after a threat actor got access to the email accounts of several employees via a phishing attack. According to a published notice of a security incident, the data breach was discovered in July 2022. How it happened American Airlin...
A week in security (September 12 – 18)
Last week on Malwarebytes Labs: The North Face hit by credential stuffing attack Facebook engineers aren't sure where all user data is kept 6 patch management best practices for businesses The MSP playbook on deciphering tech promises and shaping security culture Apple puts the password on life...