44050 matches found
Fortress Home Security Open to Remote Disarmament
A pair of vulnerabilities in the Fortress S03 WiFi Home Security System could allow cyberattackers to remotely disarm the system, leaving homes open to unlawful entry. The Fortress platform is a consumer-grade home security system that allows users to mix and match various sensors, IP cameras and...
CVE-2021-35239
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink...
CVE-2021-35240
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...
Design/Logic Flaw
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink...
Cross site scripting
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...
CVE-2021-35240
CVE-2021-35240 is a stored XSS vulnerability in SolarWinds Orion Platform related to the Help Server setting. The issue affects systems prior to 2020.2.6 HF1, with IE users being impacted due to lack of rel=noopener. It is listed among multiple vulnerabilities for the affected version (CVE-2021-3...
CVE-2021-35239
CVE-2021-35239 describes a stored XSS vulnerability in SolarWinds Orion Platform, where a user with Orion map manage rights can store XSS via a text box hyperlink. Evidence across connected documents points to SolarWinds Orion Platform (pre- HF1 patch level 2020.2.6 HF1) as affected, caused by in...
CVE-2021-35239 Stored XSS in Maps text box hyperlink Vulnerability
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink...
Update on the vulnerability in the Azure Cosmos DB Jupyter Notebook Feature
On August 12, 2021, a security researcher reported a vulnerability in the Azure Cosmos DB Jupyter Notebook feature that could potentially allow a user to gain access to another customers resources by using the accounts primary read-write key. We mitigated the vulnerability immediately. Our...
Update on the vulnerability in the Azure Cosmos DB Jupyter Notebook Feature
On August 12, 2021, a security researcher reported a vulnerability in the Azure Cosmos DB Jupyter Notebook feature that could potentially allow a user to gain access to another customers resources by using the accounts primary read-write key. We mitigated the vulnerability immediately. Our...
di.se Cross Site Scripting vulnerability OBB-2127074
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Google Docs Scams Still Pose a Threat
A 2017 worm caused havoc across the internet. One researcher is warning that despite new protections put in place, it could still happen again...
Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets
A security researcher helped Valve, the makers of the gaming platform Steam, plug an easy-to-exploit hole that allowed users to add unlimited funds to their digital wallet. Simply by changing the account’s email address, the exploit allowed anyone to artificially boost their digital billfold to...
Exploit for CVE-2021-28476
pack test and exploitdev for POC CVE-2021-28476 from bluefrostse...
Kaseya’s ‘Master Key’ to REvil Attack Leaked Online
Someone has leaked the master decryption key that Kaseya used to unlock the files encrypted by a REvil ransomware attack on the company that affected customers across 22 countries last month. However, while the key may be interesting to security researchers, it’s not likely to be of use to any of...
Metasploit Wrap-Up
Desert heat not the 1999 film This week was more quiet than normal with Black Hat USA and DEF CON, but that didn’t stop the team from delivering some small enhancements and bug fixes! We are also excited to see two new modules 15519 and 15520 from researcher Jacob Baines’ DEF CON talk Bring You...
Angry Affiliate Leaks Conti Ransomware Gang Playbook
An apparently vengeful affiliate of the Conti Gang has leaked the playbook of the ransomware group after alleging that the notorious cybercriminal organization underpaid him for doing its dirty work. A security researcher shared a comment from an online forum allegedly posted by someone who did...
Congratulations to the MSRC 2021 Most Valuable Security Researchers!
The MSRC Researcher Recognition Program offers public thanks and acknowledgement to the researchers who help protect customers through discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure. Today, we are excited to recognize this year’s Most Valuable Security...
Congratulations to the MSRC 2021 Most Valuable Security Researchers!
The MSRC Researcher Recognition Program offers public thanks and acknowledgement to the researchers who help protect customers through discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure. Today, we are excited to recognize this year’s Most Valuable Security...
PyPI Python Package Repository Patches Critical Supply Chain Flaw
The maintainers of Python Package Index PyPI last week issued fixes for three vulnerabilities, one among which could be abused to achieve arbitrary code execution and take full control of the official third-party software repository. The security weaknesses were discovered and reported by Japanes...