7738 matches found
Fixed in Apache Tomcat 7.0.104
High: Remote Code Execution via session persistence CVE-2020-9484 If: an attacker is able to control the contents and name of a file on the server; and the server is configured to use the PersistenceManager with a FileStore; and the PersistenceManager is configured with...
RATicate Group Hits Industrial Firms With Revolving Payloads
Researchers have unearthed a new cybercrime group, RATicate, which is behind several waves of malspam attacks targeting industrial companies with various information-stealing payloads – from LokiBot to Agent Tesla. At least six separate campaigns have been tied to RATicate, with the first wave...
BEC Gang Exploits G Suite, Long Domain Names in Cyberattacks
Business email compromise BEC attacks continue to be a thorn in companies’ sides, with the FBI in its IC3 annual cybercrime report saying that the attacks cost victims $1.7 billion in 2019. Making matters worse, BEC cybergangs are turning to new tactics and tricks to avoid detection and capitaliz...
robustmarketresearch.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1160335 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CISA-FBI Joint Announcement on PRC Targeting of COVID-19 Research Organizations
The Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI have jointly released a Public Service Announcement on the People’s Republic of China’s targeting of COVID-19 research organizations. CISA and FBI encourage COVID-19 research organizations to...
Fixed in Apache Tomcat 8.5.55
Important: Remote Code Execution via session persistence CVE-2020-9484 If: an attacker is able to control the contents and name of a file on the server; and the server is configured to use the PersistenceManager with a FileStore; and the PersistenceManager is configured with...
Fixed in Apache Tomcat 10.0.0-M5
Important: Remote Code Execution via session persistence CVE-2020-9484 If: an attacker is able to control the contents and name of a file on the server; and the server is configured to use the PersistenceManager with a FileStore; and the PersistenceManager is configured with...
Fixed in Apache Tomcat 9.0.35
Important: Remote Code Execution via session persistence CVE-2020-9484 If: an attacker is able to control the contents and name of a file on the server; and the server is configured to use the PersistenceManager with a FileStore; and the PersistenceManager is configured with...
WordPress Dosimple Theme 2.0 Cross Site Scripting
Document Title: =============== Wordpress Theme Dosimple v2.0 - XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2251 Release Date: ============= 2020-05-07 Vulnerability Laboratory ID VL-ID: ==================================== 225...
pentest-wiki
This repository is an information gathering library for penetration testers/researchers. It contains various tools and documentation for gathering information about a target organization, including IP analysis, whois analysis, and social media research. The library includes bookmarks for various...
Microsoft Shells Out $100K for IoT Security
Microsoft has launched a bug-bounty program for its Azure Sphere offering, which is a security suite for the internet of things IoT that encompasses hardware, OS and cloud elements. The top reward will come in at $100,000. The Azure Sphere Security Research Challenge is an expansion of a program...
Azure Sphere Security Research Challenge Now Open
The Azure Sphere Security Research Challenge is an expansion of Azure Security Lab, announced at Black Hat in August 2019. At that time, a select group of talented researchers was invited to come and do their worst, emulating criminal hackers in a customer-safe cloud environment. This new researc...
tupy.com.br Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1156523 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting tupy.com.br website and...
Azure Sphere Security Research Challenge Now Open
The Azure Sphere Security Research Challenge is an expansion of Azure Security Lab, announced at Black Hat in August 2019. At that time, a select group of talented researchers was invited to come and do their worst, emulating criminal hackers in a customer-safe cloud environment. This new researc...
Azure Sphere Security Research Challenge Now Open
The Azure Sphere Security Research Challenge is an expansion of Azure Security Lab, announced at Black Hat in August 2019. At that time, a select group of talented researchers was invited to come and do their worst, emulating criminal hackers in a customer-safe cloud environment. This new researc...
Exploit for CVE-2018-8453
cve-2018-8453-exp cve-2018-8453 exp 本程序为cve-2018-8453的利用程序。 开发\测试平台：x86: windows 10 rs2 15063 x64: windos 10 rs2 16299 附： 使用Palette来读写内核 严重声明： 本工具仅用于技术研究学习。非法使用造成一切后果，均与本人无关。...
The Weird Partisan Math of Vote-by-Mail
Research says that expanding mail-in voting doesn’t help Democrats. So why are Republicans so afraid of it?...
HardDrive 2.1 Arbitrary File Upload
Document Title: =============== HardDrive v2.1 iOS - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2221 Release Date: ============= 2020-04-29 Vulnerability Laboratory ID VL-ID: ====================================...
PHP-Fusion 9.03.50 Cross Site Scripting
Exploit Title: php-fusion 9.03.50 - Persistent Cross-Site Scripting Google Dork: "php-fusion" Date: 2020-04-30 Exploit Author: SunCSR Sun Cyber Security Research Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/infusions/downloads/downloads.php?catid=30...
Druva inSync Windows Client 6.5.2 Privilege Escalation
Exploit Title: Druva inSync Windows Client 6.5.2 - Local Privilege Escalation Date: 2020-04-28 Exploit Author: Chris Lyne Vendor Homepage: druva.com Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.5.2/inSync6.5.2r99097.msi Version: 6.5.2 Tested on: Windows 10 CVE :...