Smart toy security: How to keep your kids safe this Christmas

Christmas is coming, and so are the smart toys. The ever-present pandemic has meant a lot more staying at home this year. Videogame playing has increased considerably, because why not? Screentime for kids has gone up, because again, it’s bound to. It hasn’t brought about the end of civilisation a...

xdg-desktop-portal bug fix and enhancement update

The xdg-desktop-portal packages provide a portal front-end service to flatpak. Thesis service exposes a series of D-Bus interfaces known as portals under a well-known name org.freedesktop.portal.Desktop and object path /org/freedesktop/portal/desktop. The portal interfaces include APIs for file...

Credit card skimmer targets ASP.NET sites

Update: 2020-07-09 A reader contacted us with information about this series of attacks on .NET sites. There is a known vulnerability CVE-2017-9248 for Telerik UI for ASP.NET that is being exploited. An attacker can upload .aspx web shells and get remote code execution. This Telerik page offers...

DoubleGun Group Builds Massive Botnet Using Cloud Services

An operation from the China-based cybercrime gang known as DoubleGun Group has been disrupted, which had amassed hundreds of thousands of bots that were controlled via public cloud services, including Alibaba and Baidu Tieba. NetLab 360 researchers, in a recent posting, said that it noticed DNS...

CVE-2020-5893

In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection...

Unspecified vulnerability in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 (CNVD-2021-17243)

MB CONNECT LINE mbCONNECT24 and MB CONNECT LINE mymbCONNECT24 are both products of MB CONNECT LINE, Germany.MB CONNECT LINE mbCONNECT24 is a set of remote service portals. The product supports remote access, data logging and alarms.MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 have an unspecified vulnerability security vulnerability

MB CONNECT LINE mbCONNECT24 and MB CONNECT LINE mymbCONNECT24 are both products of MB CONNECT LINE, Germany.MB CONNECT LINE mbCONNECT24 is a set of remote service portals. The product supports remote access, data logging and alarms.MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance...

U.S. Dept Of Defense: [Partial] SSN & [PII] exposed through iPERMs Presentation Slide.

Hello @deptofdefense, when performing reconnaissance, I came across a presentation slide that displayed live data since the data is blocked out & is formatted with XXX-XX with the last 4 digits. The exposed data contains the following: UPC, Division/Brigade, Rank, Soldier Name, Last 4 digits of...

Hackers Hit Click2Gov Bill-Paying Portals in 8 Cities

The new wave of attacks comes after a previous Click2Gov hack compromised 300,000 payment cards...

Microsoft Exchange – Password Spraying

Outlook Web Access OWA portals typically are externally facing in order to allow users to get access to their emails from the Internet. This gives the opportunity to threat actors to use a common password against a valid list of usernames Password Spraying in order to get some initial access to t...

Session fixation

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently...

CVE-2019-5523

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently...

Click It Up: Targeting Local Government Payment Portals

FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associat...

Apache Portals Pluto Remote Code Execution (CVE-2018-1306)

A vulnerability exists in Apache Portals Pluto, The vulnerability is due to improper handling of http methods. A remote attacker can exploit this vulnerability by submitting a crafted request to the target server...

Apache Portals Pluto 3.0.0 Remote Code Execution

Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested on: Windows Advisory:...

FS Indiamart Clone - keywords SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Indiamart Clone - SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS...

FS Indiamart Clone SQL Injection

Exploit Title: FS Indiamart Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

FS Indiamart Clone - keywords SQL Injection

FS Indiamart Clone - keywords SQL Injection Exploit Title: FS Indiamart Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 |...

FS Indiamart Clone - 'keywords' SQL Injection

Exploit Title: FS Indiamart Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

What Triggers HTTPS Chrome Browser Warnings?

A lot of hours go into debugging the cause of and tweaking the HTTPS error warnings that pop up in Google’s Chrome browser. Researchers from Google, Purdue University, the International Institute of Information Technology Hyderabad, and the Leibniz University of Hanover Germany have spent the las...